WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 201–250 of 1,359 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Elementor Contact Form DB Plugin sb-elementor-contact-form-db Broken Access Control No login needed ≤ 2.1.3 Fixed in 2.1.4 CVE-2026-25320 Patchstack
4.3 Medium Zita Elementor Site Library Plugin zita-site-library Cross-Site Request Forgery No login needed ≤ 1.6.6 Fixed in 1.6.7 CVE-2026-25319 Patchstack
5.3 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Broken Access Control No login needed ≤ 6.5.5 Fixed in 6.5.6 CVE-2026-23543 Patchstack
5.4 Medium News Element Elementor Blog Magazine Plugin news-element Broken Access Control Missing Authorization to Authenticated (Subscriber+) Data Loss ≤ 1.0.8 CVE-2026-2284 Wordfence
4.3 Medium The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Broken Access Control Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type' ≤ 6.4.7 CVE-2026-2386 Wordfence
6.5 Medium Element Pack Addons for Elementor Plugin bdthemes-element-pack-lite Path Traversal Authenticated (Contributor+) Arbitrary File Read ≤ 8.3.17 CVE-2026-1793 Wordfence
6.4 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget ≤ 6.5.9 CVE-2026-1512 Wordfence
5.3 Medium WPZOOM Addons for Elementor – Starter Templates & Widgets Plugin wpzoom-elementor-addons Broken Access Control Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more No login needed ≤ 1.3.2 CVE-2026-2295 Wordfence
5.4 Medium ElementInvader Addons for Elementor Plugin elementinvader-addons-for-elementor Broken Access Control ≤ 1.4.1 Fixed in 1.4.2 CVE-2026-25028 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Cross-Site Scripting ≤ 2.7.12.2 Fixed in 2.7.12.3 CVE-2026-24958 Patchstack
4.3 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Broken Access Control ≤ 1.5.6.3 Fixed in 1.5.6.3 CVE-2026-24947 Patchstack
6.4 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field ≤ 3.20.7 CVE-2026-1210 Wordfence
5.4 Medium Unlimited Elements for Elementor Plugin unlimited-elements-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget ≤ 2.0.1 CVE-2025-14274 Wordfence
5.3 Medium Simple calendar for Elementor Plugin simple-calendar-for-elementor Broken Access Control Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion No login needed ≤ 1.6.6 CVE-2026-1310 Wordfence
6.4 Medium WPBITS Addons For Elementor Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.8 CVE-2025-9082 Wordfence
5.3 Medium Database for Contact Form 7, WPforms, Elementor forms Plugin contact-form-entries Broken Access Control Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export No login needed ≤ 1.4.5 CVE-2026-0825 Wordfence
4.3 Medium X Addons for Elementor Plugin x-addons-elementor Broken Access Control ≤ 1.0.23 CVE-2026-24605 Patchstack
4.3 Medium Element Invader – Template Kits for Elementor Plugin elementinvader Broken Access Control Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control ≤ 1.2.4 Fixed in 1.2.5 CVE-2026-24386 Patchstack
4.3 Medium Absolute Addons For Elementor Plugin absolute-addons Broken Access Control ≤ 1.0.14 CVE-2026-22468 Patchstack
5.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Broken Access Control Settings Change ≤ 4.11.63 Fixed in 4.11.64 CVE-2025-69300 Patchstack
6.5 Medium Contact Form & Lead Form Elementor Builder Plugin lead-form-builder Information Disclosure Sensitive Data Exposure ≤ 2.0.1 Fixed in 2.0.2 CVE-2025-68046 Patchstack
5.4 Medium Crumber Plugin crumber-elementor Broken Access Control ≤ 1.0.10 CVE-2025-66143 Patchstack
5.4 Medium Comparimager for Elementor Plugin comparimager-elementor Broken Access Control ≤ 1.0.1 CVE-2025-66142 Patchstack
5.4 Medium Uper for Elementor Plugin uper-elementor Broken Access Control ≤ 1.0.5 CVE-2025-66140 Patchstack
5.4 Medium Audier For Elementor Plugin audier-elementor Broken Access Control ≤ 1.0.9 CVE-2025-66139 Patchstack
5.4 Medium Motionger for Elementor Plugin motionger-elementor Broken Access Control ≤ 2.0.4 CVE-2025-66138 Patchstack
5.4 Medium Searcher for Elementor Plugin searcher-elementor Broken Access Control ≤ 1.0.3 CVE-2025-66137 Patchstack
5.4 Medium Carter for Elementor Plugin carter-elementor Broken Access Control ≤ 1.0.2 CVE-2025-66136 Patchstack
5.4 Medium Imager for Elementor Plugin imager-elementor Broken Access Control ≤ 2.0.4 CVE-2025-66135 Patchstack
6.5 Medium Grand Restaurant Theme Elements for Elementor Plugin grandrestaurant-elementor Cross-Site Scripting ≤ 2.1.1 CVE-2025-63026 Patchstack
4.3 Medium Element Pack Elementor Addons Plugin bdthemes-element-pack-lite Cross-Site Request Forgery No login needed ≤ 8.3.13 Fixed in 8.3.14 CVE-2025-31413 Patchstack
5.3 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed ≤ 6.5.5 CVE-2026-1004 Wordfence
6.5 Medium X Addons for Elementor Plugin x-addons-elementor Cross-Site Scripting ≤ 1.0.23 CVE-2026-22518 Patchstack
6.4 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 3.0.1 CVE-2025-14275 Wordfence
6.5 Medium The Plus Addons for Elementor Pro Plugin theplus_elementor_addon Broken Access Control ≤ 6.3.7 Fixed in 6.3.7 CVE-2025-46434 Patchstack
6.5 Medium Responsive Addons for Elementor Plugin responsive-addons-for-elementor Broken Access Control ≤ 2.0.8 Fixed in 2.0.9 CVE-2025-69363 Patchstack
6.5 Medium TheGem Theme Elements (for Elementor) Plugin thegem-elements-elementor Cross-Site Scripting ≤ 5.11.0 Fixed in 5.11.1 CVE-2025-69357 Patchstack
4.3 Medium Ultimate Store Kit Elementor Addons Plugin ultimate-store-kit Broken Access Control ≤ 2.9.4 Fixed in 2.9.5 CVE-2025-69336 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.3.3 Fixed in 5.3.4 CVE-2024-23511 Patchstack
4.3 Medium AnyWhere Elementor Pro Theme anywhere-elementor-pro Broken Access Control ≤ 2.29 CVE-2025-31046 Patchstack
5.4 Medium Worker for Elementor Plugin worker-elementor Broken Access Control ≤ 1.0.10 CVE-2025-66144 Patchstack
5.4 Medium Logger for Elementor Plugin logger-elementor Broken Access Control ≤ 1.0.9 CVE-2025-66146 Patchstack
5.4 Medium Conformer for Elementor Plugin conformer-elementor Broken Access Control ≤ 1.0.7 Fixed in 1.0.8 CVE-2025-66148 Patchstack
5.4 Medium Countdowner for Elementor Plugin countdowner-elementor Broken Access Control ≤ 1.0.4 CVE-2025-66151 Patchstack
5.4 Medium Criptopayer for Elementor Plugin criptopayer-elementor Broken Access Control ≤ 1.0.1 CVE-2025-66152 Patchstack
5.4 Medium Headinger for Elementor Plugin headinger-elementor Broken Access Control ≤ 1.1.4 CVE-2025-66153 Patchstack
5.4 Medium Couponer for Elementor Plugin couponer-elementor Broken Access Control ≤ 1.1.7 CVE-2025-66154 Patchstack
5.4 Medium Questionar for Elementor Plugin questionar-elementor Broken Access Control ≤ 1.1.7 CVE-2025-66155 Patchstack
5.4 Medium Watcher for Elementor Plugin watcher-elementor Broken Access Control ≤ 1.0.9 CVE-2025-66156 Patchstack
5.4 Medium Sliper for Elementor Plugin sliper-elementor Broken Access Control ≤ 1.0.10 CVE-2025-66157 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only