WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 351–400 of 1,359 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 8 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Responsive Addons for Elementor Plugin responsive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.0.1 CVE-2025-8215 Wordfence
4.3 Medium Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid Plugin blog-designer-for-elementor Cross-Site Request Forgery Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery No login needed ≤ 1.1.7 CVE-2025-8481 Wordfence
6.4 Medium Countdown Timer for Elementor Plugin countdown-timer-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label' ≤ 1.3.9 CVE-2025-8445 Wordfence
6.4 Medium PowerPack Lite for Elementor Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url' ≤ 2.9.4 CVE-2025-8388 Wordfence
6.4 Medium SKT Addons for Elementor Plugin skt-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 3.7 CVE-2025-8564 Wordfence
6.4 Medium aThemes Addons for Elementor Lite Plugin athemes-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 1.1.2 CVE-2025-8149 Wordfence
6.4 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.5.5.1 CVE-2025-8360 Wordfence
6.5 Medium Elementor Element Condition Plugin ele-conditions Cross-Site Scripting ≤ 1.0.5 CVE-2025-58796 Patchstack
6.5 Medium WPB Elementor Addons Plugin wpb-elementor-addons Cross-Site Scripting ≤ 1.7 CVE-2025-58793 Patchstack
6.4 Medium Events Addon for Elementor Plugin events-addon-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets ≤ 2.2.9 CVE-2025-8150 Wordfence
6.4 Medium OSM Map Widget for Elementor Plugin osm-map-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL ≤ 1.3.0 CVE-2025-8619 Wordfence
6.5 Medium Better Post & Filter Widgets for Elementor Plugin better-post-filter-widgets-for-elementor Cross-Site Scripting ≤ 1.6.1 Fixed in 1.6.2 CVE-2025-48354 Patchstack
6.4 Medium Unlimited Elements For Elementor Plugin unlimited-elements-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.5.148 CVE-2025-8603 Wordfence
6.5 Medium PDF for Elementor Forms + Drag And Drop Template Builder Plugin pdf-for-elementor-forms Cross-Site Scripting ≤ 6.2.0 Fixed in 6.3.0 CVE-2025-58208 Patchstack
6.5 Medium ElementInvader Addons for Elementor Plugin elementinvader-addons-for-elementor Cross-Site Scripting ≤ 1.3.6 Fixed in 1.3.7 CVE-2025-58205 Patchstack
6.5 Medium Xpro Elementor Addons Plugin xpro-elementor-addons Cross-Site Scripting ≤ 1.4.17 Fixed in 1.4.18 CVE-2025-58195 Patchstack
6.4 Medium Spexo Addons for Elementor Plugin sastra-essential-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 1.0.23 CVE-2025-8208 Wordfence
6.5 Medium JetElements For Elementor Plugin jet-elements Information Disclosure Sensitive Data Exposure ≤ 2.7.7 Fixed in 2.7.7.1 CVE-2025-53983 Patchstack
6.5 Medium JetBlocks For Elementor Plugin jet-blocks Information Disclosure Sensitive Data Exposure ≤ 1.3.18 Fixed in 1.3.19 CVE-2025-53988 Patchstack
6.4 Medium Anber Elementor Addon Plugin anber-elementor-addon Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link ≤ 1.0.1 CVE-2025-7439 Wordfence
6.4 Medium Anber Elementor Addon Plugin anber-elementor-addon Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link ≤ 1.0.1 CVE-2025-7440 Wordfence
6.4 Medium Essential Addons for Elementor – Popular Elementor Templates and Widgets Plugin essential-addons-for-elementor-lite Cross-Site Scripting Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items' ≤ 6.2.2 CVE-2025-8451 Wordfence
6.4 Medium Graphina - Elementor Charts and Graphs Plugin graphina-elementor-charts-and-graphs Cross-Site Scripting Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.1.3 CVE-2025-8867 Wordfence
4.3 Medium Easy Elementor Addons Plugin easy-elementor-addons Broken Access Control ≤ 2.2.7 Fixed in 2.2.8 CVE-2025-54712 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Broken Access Control ≤ 6.3.13 Fixed in 6.3.14 CVE-2025-55712 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Cross-Site Scripting ≤ 2.7.9 Fixed in 2.7.9.1 CVE-2025-55714 Patchstack
6.5 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting ≤ 1.5 Fixed in 1.5.1 CVE-2024-37945 Patchstack
6.5 Medium Easy Elementor Addons Plugin easy-elementor-addons Cross-Site Scripting ≤ 2.2.6 Fixed in 2.2.7 CVE-2025-54704 Patchstack
5.4 Medium HT Mega Plugin ht-mega-for-elementor Broken Access Control ≤ 2.9.0 Fixed in 2.9.1 CVE-2025-54695 Patchstack
6.4 Medium Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Plugin master-addons Cross-Site Scripting Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox ≤ 2.0.9.0 CVE-2025-8874 Wordfence
4.9 Medium Elementor Plugin elementor Path Traversal Authenticated (Administrator+) Arbitrary File Read via Image Import ≤ 3.30.2 CVE-2025-8081 Wordfence
6.4 Medium RT Easy Builder Plugin rt-easy-builder-advanced-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.3 CVE-2025-8462 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown ≤ 2.7.9.4 CVE-2025-7498 Wordfence
5.4 Medium Element Pack Elementor Addons and Templates Plugin bdthemes-element-pack-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content ≤ 8.1.5 CVE-2025-8100 Wordfence
4.3 Medium Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) Plugin header-footer-elementor Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Settings Update ≤ 2.4.6 CVE-2025-8488 Wordfence
6.4 Medium Medical Addon for Elementor Plugin medical-addon-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget ≤ 1.6.4 CVE-2025-8212 Wordfence
6.4 Medium Qi Addons for Elementor Plugin qi-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget ≤ 1.9.2 CVE-2025-8146 Wordfence
6.4 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets ≤ 3.7.0 CVE-2025-6228 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.3.10 CVE-2025-7646 Wordfence
6.4 Medium Stratum – Elementor Widgets Plugin stratum Cross-Site Scripting Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets ≤ 1.6.0 CVE-2025-7845 Wordfence
4.3 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Broken Access Control Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions ≤ 2.9.1 CVE-2025-8068 Wordfence
4.3 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Information Disclosure Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure ≤ 2.9.1 CVE-2025-8401 Wordfence
4.3 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Path Traversal Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions ≤ 2.9.1 CVE-2025-8151 Wordfence
6.4 Medium Magical Addons For Elementor Plugin magical-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes ≤ 1.3.8 CVE-2025-8196 Wordfence
6.4 Medium Sky Addons for Elementor Plugin sky-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 3.1.4 CVE-2025-8216 Wordfence
6.4 Medium Elementor Plugin elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget ≤ 3.30.2 CVE-2025-4566 Wordfence
6.4 Medium Elementor Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.29.0 CVE-2025-3075 Wordfence
6.4 Medium ElementsKit Elementor Addons and Templates Plugin elementskit-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget ≤ 3.5.2 CVE-2025-3614 Wordfence
6.4 Medium Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery Plugin Cross-Site Scripting Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.7 CVE-2025-7644 Wordfence
6.5 Medium Easy Elementor Addons Plugin easy-elementor-addons Cross-Site Scripting ≤ 2.2.5 Fixed in 2.2.6 CVE-2025-48295 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only