WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 251–300 of 1,023 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 21
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting ≤ 3.9.2 CVE-2025-62990 Patchstack
6.5 Medium Web and WooCommerce Addons for WPBakery Builder Plugin vc-addons-by-bit14 Cross-Site Scripting ≤ 1.5 CVE-2025-62748 Patchstack
4.3 Medium PopupKit Plugin popup-builder-block Information Disclosure Sensitive Data Exposure ≤ 2.1.5 Fixed in 2.2.1 CVE-2025-69026 Patchstack
6.5 Medium Page Builder: Live Composer Plugin live-composer-page-builder Cross-Site Scripting ≤ 2.1.22 CVE-2025-68598 Patchstack
5.4 Medium YITH Slider for page builders Plugin yith-slider-for-page-builders Broken Access Control ≤ 1.0.11 CVE-2025-68581 Patchstack
6.5 Medium WC Builder Plugin wc-builder Cross-Site Scripting ≤ 1.2.0 Fixed in 1.2.1 CVE-2025-68533 Patchstack
5.3 Medium Brave Plugin brave-popup-builder Broken Access Control No login needed ≤ 0.8.3 Fixed in 0.8.4 CVE-2025-68508 Patchstack
6.5 Medium Void Elementor WHMCS Elements For Elementor Page Builder Plugin void-elementor-whmcs-elements Cross-Site Scripting ≤ 2.0.1.2 CVE-2025-62094 Patchstack
4.4 Medium WC Builder Plugin wc-builder Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute ≤ 1.2.0 CVE-2025-14054 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.345 CVE-2025-11747 Wordfence
6.4 Medium Live Composer – Free WordPress Website Builder Plugin live-composer-page-builder Cross-Site Scripting Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.0.2 CVE-2025-13537 Wordfence
4.3 Medium SKT Page Builder Plugin skt-builder Broken Access Control ≤ 4.9 Fixed in 5.0 CVE-2025-54005 Patchstack
5.3 Medium JetFormBuilder Plugin jetformbuilder Broken Access Control Missing Authorization to Unauthenticated Form Generation No login needed ≤ 3.5.3 CVE-2025-11991 Wordfence
6.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode ≤ 6.0.6.7 CVE-2025-13610 Wordfence
6.4 Medium User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Plugin user-registration Cross-Site Scripting Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.4.6 CVE-2025-13367 Wordfence
6.4 Medium Addon Elements for Elementor Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.14.3 CVE-2025-12537 Wordfence
6.4 Medium Popup Builder – Create highly converting, mobile friendly marketing popups. Plugin popup-builder Cross-Site Scripting Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.4.1 CVE-2025-9856 Wordfence
6.5 Medium Brizy – Page Builder Plugin brizy Information Disclosure Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function ≤ 2.7.16 CVE-2025-0969 Wordfence
5.4 Medium Popup Builder Plugin easy-notify-lite Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset ≤ 1.1.37 CVE-2025-14446 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.335 CVE-2025-11376 Wordfence
4.3 Medium PDF for Contact Form 7 + Drag and Drop Template Builder Plugin pdf-for-contact-form-7 Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication ≤ 6.3.3 CVE-2025-14074 Wordfence
6.4 Medium App Landing Template Blocks for WPBakery Page Builder Plugin app-template-blocks-for-wpbakery-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 2.0.2 CVE-2025-14119 Wordfence
4.3 Medium Elementor Website Builder Plugin elementor Broken Access Control ≤ 3.33.0 Fixed in 3.33.1 CVE-2025-67588 Patchstack
5.3 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control No login needed ≤ 3.8.20 Fixed in 3.8.21 CVE-2025-67577 Patchstack
4.3 Medium Chartify Plugin chart-builder Cross-Site Request Forgery No login needed ≤ 3.6.3 Fixed in 3.6.4 CVE-2025-66529 Patchstack
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Information Disclosure WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure ≤ 2.9.4 CVE-2025-12558 Wordfence
4.3 Medium Webcake – Landing Page Builder Plugin webcake Broken Access Control Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 1.1 CVE-2025-12165 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering ≤ 2.9.4 CVE-2025-12782 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification ≤ 2.9.4 CVE-2025-11726 Wordfence
5.3 Medium Zigaform Plugin zigaform-calculator-cost-estimation-form-builder-lite Information Disclosure Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint No login needed ≤ 7.6.5 CVE-2025-13696 Wordfence
4.3 Medium SurveyJS: Drag & Drop WordPress Form Builder Plugin surveyjs Cross-Site Request Forgery Cross-Site Request Forgery to Survey Deletion No login needed ≤ 1.12.20 CVE-2025-13140 Wordfence
6.4 Medium BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library Plugin blockart-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute ≤ 2.2.13 CVE-2025-13697 Wordfence
5.3 Medium Ace Post Type Builder Plugin ace-post-type-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter No login needed ≤ 1.9 CVE-2025-13405 Wordfence
6.5 Medium Funnel Builder by FunnelKit Plugin funnel-builder Cross-Site Scripting ≤ 3.13.1.2 Fixed in 3.13.1.3 CVE-2025-66067 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.5.2 Fixed in 5.5.3 CVE-2025-66057 Patchstack
6.4 Medium FunnelKit – Funnel Builder for WooCommerce Checkout Plugin funnel-builder Cross-Site Scripting Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode ≤ 3.13.1.2 CVE-2025-12878 Wordfence
6.4 Medium User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Plugin profile-builder Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.14.8 CVE-2025-13054 Wordfence
6.4 Medium Gutenify - Visual Site Builder Blocks & Site Templates Plugin gutenify Cross-Site Scripting Visual Site Builder Blocks & Site Templates <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up block ≤ 1.5.9 CVE-2025-8605 Wordfence
5.3 Medium JetFormBuilder Plugin jetformbuilder Broken Access Control No login needed ≤ 3.5.3 Fixed in 3.5.4 CVE-2025-64384 Patchstack
4.3 Medium WooCommerce PDF Invoice Builder Plugin woo-pdf-invoice-builder Broken Access Control ≤ 1.2.150 Fixed in 1.2.151 CVE-2025-64269 Patchstack
4.3 Medium Page Builder: Pagelayer – Drag and Drop website builder Plugin pagelayer Broken Access Control Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference ≤ 2.0.5 CVE-2025-12366 Wordfence
6.4 Medium Nonaki – Drag and Drop Email Template builder and Newsletter Plugin nonaki-email-template-customizer Cross-Site Scripting Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields ≤ 1.0.11 CVE-2025-12644 Wordfence
6.5 Medium Cost Calculator Builder Plugin cost-calculator-builder Broken Access Control No login needed ≤ 3.5.32 Fixed in 3.5.33 CVE-2025-62049 Patchstack
4.3 Medium Depicter — Popup & Slider Builder Plugin depicter Broken Access Control Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload ≤ 4.0.4 CVE-2025-11373 Wordfence
6.3 Medium FunnelKit Plugin funnel-builder Cross-Site Scripting Reflected XSS No login needed < 3.12.0.1 Fixed in 3.12.0.1 CVE-2025-10567 WPScan
6.4 Medium Reuse Builder Plugin reuse-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.7 CVE-2025-11812 Wordfence
6.4 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes ≤ 12.2.7 CVE-2025-11841 Wordfence
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting ≤ 3.21.1 Fixed in 3.21.1 CVE-2025-48088 Patchstack
6.5 Medium Builderall Builder Plugin builderall-cheetah-for-wp Cross-Site Scripting ≤ 3.0.1 CVE-2025-62987 Patchstack
5.3 Medium WP Popup Builder Plugin wp-popup-builder Information Disclosure Sensitive Data Exposure No login needed ≤ 1.3.8 Fixed in 1.3.9 CVE-2025-62902 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only