WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 151–200 of 286 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Essential Blocks for Gutenberg Plugin essential-blocks Broken Access Control ≤ 4.2.0 Fixed in 4.2.1 CVE-2023-47760 Patchstack
6.5 Medium Essential Blocks for Gutenberg Plugin essential-blocks Broken Access Control Multiple Subscriber+ Broken Access Control ≤ 4.2.0 Fixed in 4.2.1 CVE-2023-51360 Patchstack
5.4 Medium Essential Blocks for Gutenberg Plugin essential-blocks Broken Access Control Multiple Contributor+ Broken Access Control ≤ 4.2.0 Fixed in 4.2.1 CVE-2023-51359 Patchstack
5.9 Medium Borderless Plugin borderless Cross-Site Scripting Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin <= 1.5.8 - Cross Site Scripting (XSS) ≤ 1.5.8 Fixed in 1.5.9 CVE-2024-54211 Patchstack
6.4 Medium Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor Plugin gutentor Cross-Site Scripting Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 3.3.9 CVE-2024-10178 Wordfence
6.4 Medium Spectra – WordPress Gutenberg Blocks Plugin ultimate-addons-for-gutenberg Cross-Site Scripting WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget ≤ 2.16.2 CVE-2024-10484 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin Cross-Site Scripting Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' ≤ 4.1.3 CVE-2024-11203 Wordfence
5.3 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Path Traversal Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View No login needed ≤ 3.0.6 CVE-2024-11219 Wordfence
6.4 Medium Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin Cross-Site Scripting Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.3.3 CVE-2024-10785 Wordfence
6.4 Medium Getwid – Gutenberg Blocks Plugin getwid Cross-Site Scripting Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.12 CVE-2024-10872 Wordfence
4.3 Medium Easy Accordion Gutenberg Block Plugin easy-accordion-block Broken Access Control ≤ 1.2.3 Fixed in 1.2.5 CVE-2024-51660 Patchstack
2.7 Low Otter - Gutenberg Block Plugin otter-blocks Broken Access Control ≤ 3.0.3 Fixed in 3.0.4 CVE-2024-51671 Patchstack
4.3 Medium Content Slider Block – Create fully functional slider with Gutenberg block Plugin content-slider-block Information Disclosure Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure ≤ 3.1.5 CVE-2024-10667 Wordfence
4.3 Medium Spectra Plugin ultimate-addons-for-gutenberg Broken Access Control ≤ 2.13.7 Fixed in 2.13.8 CVE-2024-37517 Patchstack
4.3 Medium Recipe Card Blocks for Gutenberg & Elementor Plugin recipe-card-blocks-by-wpzoom Broken Access Control ≤ 3.3.1 Fixed in 3.3.2 CVE-2024-43293 Patchstack
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 3.0.4 CVE-2024-10367 Wordfence
6.4 Medium Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget ≤ 3.3.1 CVE-2024-9655 Wordfence
6.5 Medium Post Grid and Gutenberg Blocks Plugin post-grid Cross-Site Scripting ≤ 2.2.93 Fixed in 2.2.94 CVE-2024-50432 Patchstack
7.3 High Uix Shortcodes – Compatible with Gutenberg Plugin uix-shortcodes Arbitrary Shortcode Execution Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.9.9 CVE-2024-9772 Wordfence
7.1 High EasyJobs Plugin easyjobs Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.4.14 Fixed in 2.4.15 CVE-2024-43997 Patchstack
5.3 Medium Stackable – Page Builder Gutenberg Blocks Plugin stackable-ultimate-gutenberg-blocks Content Injection Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection No login needed ≤ 3.13.6 CVE-2024-8760 Wordfence
6.5 Medium Post Grid and Gutenberg Blocks Plugin post-grid Cross-Site Scripting ≤ 2.2.89 Fixed in 2.2.90 CVE-2024-47340 Patchstack
6.5 Medium Premium Blocks – Gutenberg Blocks Plugin premium-blocks-for-gutenberg Cross-Site Scripting ≤ 2.1.33 Fixed in 2.1.34 CVE-2024-47368 Patchstack
6.5 Medium Essential Blocks for Gutenberg Plugin essential-blocks Cross-Site Scripting ≤ 4.8.4 Fixed in 4.9.0 CVE-2024-47385 Patchstack
6.5 Medium WP Travel Gutenberg Blocks Plugin wp-travel-blocks Cross-Site Scripting ≤ 3.6.0 Fixed in 3.7.0 CVE-2024-47627 Patchstack
6.4 Medium Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg Plugin guten-post-layout Cross-Site Scripting An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute ≤ 1.2.4 CVE-2024-8288 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.9.7 CVE-2024-8668 Wordfence
6.4 Medium GutenGeek Free Gutenberg Blocks Plugin gtg-advanced-blocks Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.1.3 CVE-2024-9073 Wordfence
6.4 Medium Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) Plugin graphicsly Cross-Site Scripting The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.2 CVE-2024-9069 Wordfence
7.1 High SKT Templates – Elementor & Gutenberg templates Plugin skt-templates Cross-Site Scripting Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) No login needed ≤ 6.14 Fixed in 6.15 CVE-2024-44007 Patchstack
6.5 Medium Gutenberg Blocks Plugin unlimited-blocks Cross-Site Scripting Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) ≤ 1.2.8 CVE-2024-44049 Patchstack
8.8 High Post Grid and Gutenberg Blocks Plugin post-grid Privilege Escalation Authenticated (Subscriber+) Privilege Escalation 2.2.87 – 2.2.90 CVE-2024-8253 Wordfence
6.4 Medium Gutenberg Page Builder Blocks & Ready-Made Patterns Library Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.4 CVE-2024-8325 Wordfence
6.5 Medium Gutenverse Plugin gutenverse Cross-Site Scripting Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.9.4 - Cross Site Scripting (XSS) ≤ 1.9.4 Fixed in 2.0.0 CVE-2024-43920 Patchstack
6.5 Medium SKT Blocks – Gutenberg based Page Builder Plugin skt-blocks Cross-Site Scripting ≤ 1.5 CVE-2024-43946 Patchstack
6.5 Medium WP Travel Gutenberg Blocks Plugin wp-travel-blocks Cross-Site Scripting ≤ 3.5.1 Fixed in 3.6.0 CVE-2024-43284 Patchstack
6.5 Medium Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor Plugin gutentor Cross-Site Scripting Gutenberg Blocks – Page Builder for Gutenberg Editor plugin <= 3.3.5 - Cross Site Scripting (XSS) ≤ 3.3.5 Fixed in 3.3.6 CVE-2024-43308 Patchstack
6.5 Medium Responsive Blocks – WordPress Gutenberg Blocks Plugin responsive-block-editor-addons Cross-Site Scripting WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) ≤ 1.8.8 Fixed in 1.8.9 CVE-2024-43335 Patchstack
6.4 Medium Gutenberg Blocks, Page Builder – ComboBlocks Plugin post-grid Cross-Site Scripting ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block ≤ 2.2.84 CVE-2024-7588 Wordfence
6.5 Medium Spectra Plugin ultimate-addons-for-gutenberg Cross-Site Scripting ≤ 2.14.1 Fixed in 2.15.1 CVE-2024-7590 Patchstack
6.5 Medium BetterDocs Plugin betterdocs Cross-Site Scripting Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin <= 3.5.8 - Cross Site Scripting (XSS) ≤ 3.5.8 Fixed in 3.5.9 CVE-2024-43227 Patchstack
5.4 Medium Gutenberg Blocks with AI by Kadence WP Plugin Cross-Site Scripting Contributor+ Stored XSS < 3.2.39 Fixed in 3.2.39 CVE-2024-6884 WPScan
4.3 Medium TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder Plugin templatespare Broken Access Control TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update ≤ 2.4.2 CVE-2024-6872 Wordfence
6.5 Medium Ultimate Blocks – Gutenberg Blocks Plugin ultimate-blocks Cross-Site Scripting WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) ≤ 3.1.9 Fixed in 3.2.0 CVE-2024-37457 Patchstack
6.5 Medium Gutenberg Plugin gutenberg Cross-Site Scripting ≤ 18.6.0 Fixed in 18.6.1 CVE-2024-37492 Patchstack
6.5 Medium Premium Blocks – Gutenberg Blocks Plugin premium-blocks-for-gutenberg Cross-Site Scripting Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) ≤ 2.1.27 Fixed in 2.1.28 CVE-2024-37519 Patchstack
6.5 Medium Caxton – Create Pro page layouts in Gutenberg Plugin caxton Cross-Site Scripting Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS) ≤ 1.30.1 CVE-2024-37948 Patchstack
6.5 Medium Magical Posts Display – Elementor & Gutenberg Posts Blocks Plugin magical-posts-display Cross-Site Scripting ≤ 1.2.38 Fixed in 1.2.39 CVE-2024-37951 Patchstack
6.5 Medium Post Layouts for Gutenberg Plugin post-layouts Cross-Site Scripting ≤ 1.2.7 CVE-2024-38682 Patchstack
6.5 Medium SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) Plugin slingblocks Cross-Site Scripting ≤ 1.4.1 Fixed in 1.5.0 CVE-2024-38684 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only