WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 301–350 of 1,023 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 7 of 21
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium WP VR – 360 Panorama and Free Virtual Tour Builder Plugin wpvr Broken Access Control Improper Authorization to Authenticated (Contributor+) Plugin Settings Update ≤ 8.5.41 CVE-2025-12005 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.4 CVE-2025-11823 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter ≤ 5.4.5 CVE-2025-7730 Wordfence
6.4 Medium Beaver Builder Plugin (Starter Version) Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play' ≤ 2.9.2.1 CVE-2025-8427 Wordfence
5.9 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting ≤ 1.0.334 Fixed in 1.0.334 CVE-2025-59593 Patchstack
6.5 Medium Fusion Builder Plugin fusion-builder Cross-Site Scripting ≤ 3.13.2 Fixed in 3.13.3 CVE-2025-49940 Patchstack
6.5 Medium JetWooBuilder Plugin jet-woo-builder Cross-Site Scripting ≤ 2.1.20 Fixed in 2.1.20.1 CVE-2025-49928 Patchstack
6.5 Medium JetWooBuilder Plugin jet-woo-builder Cross-Site Scripting ≤ 2.1.20.1 CVE-2025-49927 Patchstack
6.4 Medium Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Plugin essential-blocks Cross-Site Scripting Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.7.1 CVE-2025-11270 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.6 CVE-2025-10006 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting < 3.21.1 Fixed in 3.21.1 CVE-2025-11814 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Stored Cross-Site Scripting via vc_custom_heading Shortcode ≤ 8.6.1 CVE-2025-11161 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Stored Cross-Site Scripting via Custom JS Module ≤ 8.6.1 CVE-2025-11160 Wordfence
4.3 Medium SureForms – Drag and Drop Form Builder Plugin sureforms Broken Access Control Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure ≤ 1.12.1 CVE-2025-10732 Wordfence
6.8 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Author+ Stored XSS < 6.3.16 Fixed in 6.3.16 CVE-2025-9698 WPScan
4.9 Medium NEX-Forms – Ultimate Forms Plugin nex-forms-express-wp-form-builder SQL Injection Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection ≤ 9.1.6 CVE-2025-10185 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode ≤ 1.0.334 CVE-2025-9560 Wordfence
5.3 Medium Chartify – WordPress Chart Plugin chart-builder Authentication Bypass WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function No login needed ≤ 3.5.9 CVE-2025-11171 Wordfence
4.3 Medium WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Plugin wdesignkit Broken Access Control Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function ≤ 1.2.16 CVE-2025-9029 Wordfence
4.3 Medium cForms – Light speed fast Form Builder Plugin cforms-plugin Cross-Site Request Forgery Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery No login needed ≤ 3.0.0 CVE-2025-9898 Wordfence
4.3 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Cross-Site Request Forgery The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion No login needed ≤ 3.12.0 CVE-2025-10498 Wordfence
4.3 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Cross-Site Request Forgery The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 3.12.0 CVE-2025-10499 Wordfence
6.4 Medium Themify Builder Plugin themify-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 7.6.9 CVE-2025-9353 Wordfence
6.5 Medium Fusion Page Builder : Extension – Gallery Plugin fusion-extension-gallery Cross-Site Scripting Gallery Plugin <= 1.7.6 - Cross Site Scripting (XSS) ≤ 1.7.6 Fixed in 1.7.7 CVE-2025-58965 Patchstack
6.5 Medium HT Mega – Absolute Addons for WPBakery Page Builder Plugin ht-mega-for-wpbakery Cross-Site Scripting Absolute Addons for WPBakery Page Builder Plugin <= 1.0.9 - Cross Site Scripting (XSS) ≤ 1.0.9 Fixed in 1.1.0 CVE-2025-53463 Patchstack
5.9 Medium Draft Plugin website-builder Cross-Site Scripting ≤ 3.0.9 CVE-2025-58033 Patchstack
6.5 Medium SQL Chart Builder Plugin sql-chart-builder Cross-Site Scripting ≤ 2.3.7.2 CVE-2025-58233 Patchstack
6.5 Medium StylePress for Elementor Plugin full-site-builder-for-elementor Cross-Site Scripting ≤ 1.2.1 CVE-2025-58254 Patchstack
4.3 Medium Internal Links Manager Plugin seo-automated-link-building Cross-Site Request Forgery No login needed ≤ 3.0.1 CVE-2025-9949 Wordfence
4.3 Medium SureForms – Drag and Drop Form Builder Plugin sureforms Broken Access Control Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation ≤ 1.12.0 CVE-2025-10489 Wordfence
5.4 Medium Kubio AI Page Builder Plugin kubio Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation ≤ 2.6.3 CVE-2025-8487 Wordfence
6.4 Medium Smart Table Builder Plugin smart-table-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 1.0.1 CVE-2025-9126 Wordfence
6.5 Medium Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Plugin fluentform PHP Object Injection Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read 5.1.16 – 6.1.1 CVE-2025-9260 Wordfence
6.1 Medium Beaver Builder Plugin (Lite Version) Plugin beaver-builder-lite-version Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.9.2.1 CVE-2025-8897 Wordfence
6.5 Medium PDF for Elementor Forms + Drag And Drop Template Builder Plugin pdf-for-elementor-forms Cross-Site Scripting ≤ 6.2.0 Fixed in 6.3.0 CVE-2025-58208 Patchstack
6.5 Medium Xpro Theme Builder Plugin xpro-theme-builder Broken Access Control ≤ 1.2.9 Fixed in 1.2.10 CVE-2025-58198 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.4.3 Fixed in 5.4.4 CVE-2025-58194 Patchstack
4.3 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Broken Access Control ≤ 12.1.1 Fixed in 12.1.2 CVE-2025-57884 Patchstack
4.3 Medium Themify Builder Plugin themify-builder Broken Access Control ≤ 7.6.7 Fixed in 7.6.8 CVE-2025-49396 Patchstack
6.5 Medium JetWooBuilder Plugin jet-woo-builder Information Disclosure Sensitive Data Exposure ≤ 2.1.20 Fixed in 2.1.20.1 CVE-2025-53998 Patchstack
6.4 Medium User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Plugin profile-builder Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 3.14.3 CVE-2025-8896 Wordfence
6.4 Medium WP Table Builder – WordPress Table Plugin wp-table-builder Cross-Site Scripting WordPress Table Plugin <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.0.12 CVE-2025-8604 Wordfence
6.5 Medium Build App Online Plugin build-app-online Cross-Site Request Forgery No login needed ≤ 1.0.23 CVE-2025-53249 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.15.0 Fixed in 45.15.0 CVE-2025-55709 Patchstack
6.5 Medium WP Table Builder Plugin wp-table-builder Cross-Site Scripting ≤ 2.0.12 Fixed in 2.0.13 CVE-2025-55711 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Broken Access Control ≤ 6.3.13 Fixed in 6.3.14 CVE-2025-55712 Patchstack
6.5 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting ≤ 1.5 Fixed in 1.5.1 CVE-2024-37945 Patchstack
4.3 Medium Chartify Plugin chart-builder Cross-Site Request Forgery No login needed ≤ 3.5.3 Fixed in 3.5.4 CVE-2025-54673 Patchstack
4.2 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Path Traversal Visual Drag and Drop Editor <= 1.27.8 - Path Traversal ≤ 1.27.8 Fixed in 1.27.9 CVE-2025-52712 Patchstack
6.4 Medium RT Easy Builder Plugin rt-easy-builder-advanced-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.3 CVE-2025-8462 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only