WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 101–150 of 1,407 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 29
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Solace Extra Plugin solace-extra Information Disclosure Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content No login needed < 1.7.0 Fixed in 1.7.0 CVE-2026-16966 WPScan
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode ≤ 2.1.19 CVE-2026-16788 Wordfence
6.4 Medium WPBakery Page Builder Plugin js_composer Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter ≤ 8.7.4 CVE-2026-15101 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode ≤ 2.1.19 CVE-2026-16786 Wordfence
6.1 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'email' Parameter No login needed ≤ 4.0.0 CVE-2026-75964 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode ≤ 2.1.19 CVE-2026-16787 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute ≤ 2.1.19 CVE-2026-13203 Wordfence
6.4 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute ≤ 4.0.0 CVE-2026-75965 Wordfence
7.4 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Broken Authentication No login needed ≤ 6.0.9.8 Fixed in 6.0.9.9 CVE-2026-82225 Patchstack
7.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.9.8 Fixed in 6.0.9.9 CVE-2026-82221 Patchstack
8.2 High Profile Builder Plugin Authentication Bypass Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass No login needed 3.8.1 – < 4.0.1 Fixed in 4.0.1 CVE-2026-76548 WPScan
6.6 Medium Profile Builder Plugin PHP Object Injection Admin+ PHP Object Injection via Import/Export 3.3.4 – < 4.0.1 Fixed in 4.0.1 CVE-2026-76547 WPScan
6.8 Medium Profile Builder Plugin Cross-Site Scripting Contributor+ Stored XSS via Format Date Shortcode 3.3.4 – < 4.0.1 Fixed in 4.0.1 CVE-2026-76546 WPScan
7.2 High WP User Frontend Plugin PHP Object Injection Editor+ PHP Object Injection via AI Form Builder < 4.3.10 Fixed in 4.3.10 CVE-2026-14558 WPScan
6.4 Medium Avada (Fusion) Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute ≤ 3.15.6 CVE-2026-16654 Wordfence
5.3 Medium WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps Plugin wp-data-access Broken Access Control No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access No login needed ≤ 5.5.68 CVE-2026-3235 Wordfence
6.4 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI ≤ 12.8.9 CVE-2026-5092 Wordfence
9.8 Critical Avada Theme Remote Code Execution Unauthenticated Remote Code Execution via Arbitrary File Write No login needed ≤ 3.16, ≤ 7.16 CVE-2026-18431 Wordfence
5.5 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager SQL Injection Admin+ SQLi via 'rm_sortby' Parameter < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-77790 WPScan
7.2 High ShopEngine Elementor WooCommerce Builder Addon Plugin shopengine Privilege Escalation Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes ≤ 4.9.4 CVE-2026-75971 Wordfence
8.6 High ShopBuilder Pro – Elementor WooCommerce Builder Addons Plugin shopbuilder-pro Arbitrary File Deletion Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion No login needed ≤ 2.2.0 CVE-2026-32477 Patchstack
4.3 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Broken Access Control Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' ≤ 12.8.9 CVE-2026-5093 Wordfence
5.3 Medium Themify Builder Plugin themify-builder Broken Access Control Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action No login needed ≤ 7.8.0 CVE-2026-75027 Wordfence
6.6 Medium Royal Elementor Addons Plugin Remote Code Execution Admin+ Remote Code Execution via Widget Builder < 1.7.1066 Fixed in 1.7.1066 CVE-2026-13405 WPScan
4.3 Medium WP Table Builder Plugin wp-table-builder Broken Access Control ≤ 2.2.0 CVE-2026-74006 Patchstack
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection No login needed ≤ 6.0.9.7 Fixed in 6.0.9.8 CVE-2026-73341 Patchstack
9.8 Critical Contact Form, Survey, Quiz & Popup Form Builder – ARForms Plugin arforms-form-builder PHP Object Injection ARForms <= 1.8.5 - Unauthenticated PHP Object Injection No login needed ≤ 1.8.5 CVE-2024-13784 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.6.8 CVE-2026-2357 Wordfence
7.5 High Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Information Disclosure Unauthenticated Customer File Disclosure via getpublicfileupload No login needed < 1.2.176 Fixed in 1.2.176 CVE-2026-19728 WPScan
4.3 Medium Kubio AI Page Builder Plugin kubio Broken Access Control Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action ≤ 2.8.5 CVE-2026-16779 Wordfence
8.8 High Royal Addons for Elementor Plugin royal-elementor-addons Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting ≤ 1.7.1064 CVE-2026-17123 Wordfence
4.3 Medium Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI Plugin everest-forms Broken Access Control Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints ≤ 3.5.2 CVE-2026-13167 Wordfence
5.3 Medium Product Table & List Builder For WooCommerce Plugin wc-product-table-lite Content Injection Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter No login needed ≤ 5.6.0 CVE-2026-15441 Wordfence
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Admin+) SQL Injection via 'additional_params' Parameter ≤ 9.2.4 CVE-2026-15602 Wordfence
9.8 Critical User Profile Builder Plugin profile-builder Authentication Bypass Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter No login needed ≤ 3.16.4 CVE-2026-15826 Wordfence
6.4 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter ≤ 2.10.2.2 CVE-2026-17090 Wordfence
9.8 Critical Fluent Forms Pro Plugin fluentformpro Other Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build No login needed 6.2.7 CVE-2026-73532 VulnCheck
9.8 Critical Ninja Tables Pro Plugin ninja-tables Other Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build No login needed 5.2.11 CVE-2026-73533 VulnCheck
6.4 Medium Kirki - Freeform Page Builder, Website Builder & Customizer Plugin Cross-Site Scripting Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode ≤ 6.2.0 CVE-2026-16974 Wordfence
4.3 Medium Solace Extra Plugin solace-extra Cross-Site Request Forgery Subscriber+ Post Meta Update via solace_update_sitebuilder_status < 1.6.1 Fixed in 1.6.1 CVE-2026-16965 WPScan
5.4 Medium YMC Filter Plugin ymc-smart-filter Cross-Site Scripting Contributor+ Stored XSS via Layout Builder Schema 3.6.0 – < 3.12.8 Fixed in 3.12.8 CVE-2026-16558 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Amount-Blind PayPal Verification No login needed < 6.0.9.5 Fixed in 6.0.9.5 CVE-2026-15208 WPScan
5.3 Medium Profile Builder Plugin profile-builder Broken Access Control No login needed ≤ 3.16.5 Fixed in 3.16.6 CVE-2026-66701 Patchstack
6.5 Medium Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder Plugin gutena-forms Authentication Bypass Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication No login needed ≤ 1.9.0 Fixed in 2.0.0 CVE-2026-66425 Patchstack
7.5 High JetFormBuilder Plugin jetformbuilder Broken Access Control No login needed ≤ 3.6.4.1 Fixed in 3.6.4.2 CVE-2026-28140 Patchstack
7.2 High FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More Plugin formgent Cross-Site Scripting Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.9.2 CVE-2025-15028 Wordfence
6.5 Medium Cost Calculator Builder Plugin cost-calculator-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure ≤ 3.6.17 CVE-2026-7753 Wordfence
2.7 Low Brizy - Page Builder Plugin Broken Access Control Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR < 2.8.19 Fixed in 2.8.19 CVE-2026-16070 WPScan
6.8 Medium Brizy - Page Builder Plugin Cross-Site Scripting Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point < 2.8.19 Fixed in 2.8.19 CVE-2026-16069 WPScan
3.5 Low Brizy - Page Builder Plugin Cross-Site Scripting Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset < 2.8.19 Fixed in 2.8.19 CVE-2026-16068 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only