WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 301–350 of 1,616 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 7 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium ElementInvader Addons for Elementor Plugin elementinvader-addons-for-elementor Broken Access Control ≤ 1.4.1 Fixed in 1.4.2 CVE-2026-25028 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Cross-Site Scripting ≤ 2.7.12.2 Fixed in 2.7.12.3 CVE-2026-24958 Patchstack
4.3 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Broken Access Control ≤ 1.5.6.3 Fixed in 1.5.6.3 CVE-2026-24947 Patchstack
6.4 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field ≤ 3.20.7 CVE-2026-1210 Wordfence
5.4 Medium Unlimited Elements for Elementor Plugin unlimited-elements-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget ≤ 2.0.1 CVE-2025-14274 Wordfence
5.3 Medium Simple calendar for Elementor Plugin simple-calendar-for-elementor Broken Access Control Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion No login needed ≤ 1.6.6 CVE-2026-1310 Wordfence
6.4 Medium WPBITS Addons For Elementor Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.8 CVE-2025-9082 Wordfence
5.3 Medium Database for Contact Form 7, WPforms, Elementor forms Plugin contact-form-entries Broken Access Control Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export No login needed ≤ 1.4.5 CVE-2026-0825 Wordfence
7.2 High TableMaster for Elementor Plugin tablemaster-for-elementor Server-Side Request Forgery Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter No login needed ≤ 1.3.6 CVE-2025-14610 Wordfence
3.7 Low MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Plugin metform Information Disclosure Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value No login needed ≤ 4.1.0 CVE-2026-0633 Wordfence
4.3 Medium X Addons for Elementor Plugin x-addons-elementor Broken Access Control ≤ 1.0.23 CVE-2026-24605 Patchstack
7.5 High Kentha Elementor Widgets Plugin kentha-elementor Local File Inclusion ≤ 3.1 Fixed in 3.1 CVE-2026-24390 Patchstack
4.3 Medium Element Invader – Template Kits for Elementor Plugin elementinvader Broken Access Control Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control ≤ 1.2.4 Fixed in 1.2.5 CVE-2026-24386 Patchstack
4.3 Medium Absolute Addons For Elementor Plugin absolute-addons Broken Access Control ≤ 1.0.14 CVE-2026-22468 Patchstack
9.1 Critical Xpro Elementor Addons Plugin xpro-elementor-addons Arbitrary File Upload ≤ 1.4.19.1 Fixed in 1.4.20 CVE-2025-69312 Patchstack
5.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Broken Access Control Settings Change ≤ 4.11.63 Fixed in 4.11.64 CVE-2025-69300 Patchstack
8.5 High Happy Addons for Elementor Plugin happy-elementor-addons SQL Injection ≤ 3.20.4 Fixed in 3.20.6 CVE-2025-68999 Patchstack
6.5 Medium Contact Form & Lead Form Elementor Builder Plugin lead-form-builder Information Disclosure Sensitive Data Exposure ≤ 2.0.1 Fixed in 2.0.2 CVE-2025-68046 Patchstack
7.1 High AdForest Elementor Plugin adforest-elementor Cross-Site Scripting No login needed ≤ 3.0.11 Fixed in 3.0.12 CVE-2025-67947 Patchstack
5.4 Medium Crumber Plugin crumber-elementor Broken Access Control ≤ 1.0.10 CVE-2025-66143 Patchstack
5.4 Medium Comparimager for Elementor Plugin comparimager-elementor Broken Access Control ≤ 1.0.1 CVE-2025-66142 Patchstack
5.4 Medium Uper for Elementor Plugin uper-elementor Broken Access Control ≤ 1.0.5 CVE-2025-66140 Patchstack
5.4 Medium Audier For Elementor Plugin audier-elementor Broken Access Control ≤ 1.0.9 CVE-2025-66139 Patchstack
5.4 Medium Motionger for Elementor Plugin motionger-elementor Broken Access Control ≤ 2.0.4 CVE-2025-66138 Patchstack
5.4 Medium Searcher for Elementor Plugin searcher-elementor Broken Access Control ≤ 1.0.3 CVE-2025-66137 Patchstack
5.4 Medium Carter for Elementor Plugin carter-elementor Broken Access Control ≤ 1.0.2 CVE-2025-66136 Patchstack
5.4 Medium Imager for Elementor Plugin imager-elementor Broken Access Control ≤ 2.0.4 CVE-2025-66135 Patchstack
6.5 Medium Grand Restaurant Theme Elements for Elementor Plugin grandrestaurant-elementor Cross-Site Scripting ≤ 2.1.1 CVE-2025-63026 Patchstack
4.3 Medium Element Pack Elementor Addons Plugin bdthemes-element-pack-lite Cross-Site Request Forgery No login needed ≤ 8.3.13 Fixed in 8.3.14 CVE-2025-31413 Patchstack
9.8 Critical LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Privilege Escalation Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter No login needed ≤ 1.5.6.3 CVE-2026-0920 Wordfence
5.3 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed ≤ 6.5.5 CVE-2026-1004 Wordfence
6.5 Medium X Addons for Elementor Plugin x-addons-elementor Cross-Site Scripting ≤ 1.0.23 CVE-2026-22518 Patchstack
6.4 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 3.0.1 CVE-2025-14275 Wordfence
6.5 Medium The Plus Addons for Elementor Pro Plugin theplus_elementor_addon Broken Access Control ≤ 6.3.7 Fixed in 6.3.7 CVE-2025-46434 Patchstack
6.5 Medium Responsive Addons for Elementor Plugin responsive-addons-for-elementor Broken Access Control ≤ 2.0.8 Fixed in 2.0.9 CVE-2025-69363 Patchstack
6.5 Medium TheGem Theme Elements (for Elementor) Plugin thegem-elements-elementor Cross-Site Scripting ≤ 5.11.0 Fixed in 5.11.1 CVE-2025-69357 Patchstack
7.5 High TheGem Theme Elements (for Elementor) Plugin thegem-elements-elementor Local File Inclusion ≤ 5.11.0 Fixed in 5.11.1 CVE-2025-69356 Patchstack
4.3 Medium Ultimate Store Kit Elementor Addons Plugin ultimate-store-kit Broken Access Control ≤ 2.9.4 Fixed in 2.9.5 CVE-2025-69336 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.3.3 Fixed in 5.3.4 CVE-2024-23511 Patchstack
4.3 Medium AnyWhere Elementor Pro Theme anywhere-elementor-pro Broken Access Control ≤ 2.29 CVE-2025-31046 Patchstack
5.4 Medium Worker for Elementor Plugin worker-elementor Broken Access Control ≤ 1.0.10 CVE-2025-66144 Patchstack
5.4 Medium Logger for Elementor Plugin logger-elementor Broken Access Control ≤ 1.0.9 CVE-2025-66146 Patchstack
5.4 Medium Conformer for Elementor Plugin conformer-elementor Broken Access Control ≤ 1.0.7 Fixed in 1.0.8 CVE-2025-66148 Patchstack
5.4 Medium Countdowner for Elementor Plugin countdowner-elementor Broken Access Control ≤ 1.0.4 CVE-2025-66151 Patchstack
5.4 Medium Criptopayer for Elementor Plugin criptopayer-elementor Broken Access Control ≤ 1.0.1 CVE-2025-66152 Patchstack
5.4 Medium Headinger for Elementor Plugin headinger-elementor Broken Access Control ≤ 1.1.4 CVE-2025-66153 Patchstack
5.4 Medium Couponer for Elementor Plugin couponer-elementor Broken Access Control ≤ 1.1.7 CVE-2025-66154 Patchstack
5.4 Medium Questionar for Elementor Plugin questionar-elementor Broken Access Control ≤ 1.1.7 CVE-2025-66155 Patchstack
5.4 Medium Watcher for Elementor Plugin watcher-elementor Broken Access Control ≤ 1.0.9 CVE-2025-66156 Patchstack
5.4 Medium Sliper for Elementor Plugin sliper-elementor Broken Access Control ≤ 1.0.10 CVE-2025-66157 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only