WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 401–450 of 1,407 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 9 of 29
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Taskbuilder Plugin taskbuilder Cross-Site Scripting No login needed ≤ 4.0.9 Fixed in 5.0.0 CVE-2025-67933 Patchstack
5.3 Medium Fluent Forms Plugin fluentform Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder No login needed ≤ 6.1.7 CVE-2025-13722 Wordfence
4.4 Medium Email Customizer for WooCommerce | Drag and Drop Email Templates Builder Plugin email-customizer-for-woocommerce Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content ≤ 2.6.7 CVE-2025-13974 Wordfence
6.4 Medium Stylish Order Form Builder Plugin stylish-order-form-builder Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter ≤ 1.0 CVE-2025-13531 Wordfence
7.1 High Woocommerce Sales Funnel Builder Plugin woosales Cross-Site Scripting Reflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress plugins No login needed ≤ 1.1, ≤ 1.2 CVE-2025-30631 Patchstack
4.3 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Broken Access Control ≤ 1.27.9 Fixed in 1.27.10 CVE-2025-69345 Patchstack
4.3 Medium Popupkit Plugin popup-builder-block Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion ≤ 2.2.0 CVE-2025-14441 Wordfence
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.3.3 Fixed in 5.3.4 CVE-2024-23511 Patchstack
6.1 Medium Shopbuilder Plugin shopbuilder Cross-Site Scripting Reflected XSS No login needed < 3.2.2 Fixed in 3.2.2 CVE-2025-13456 WPScan
8.5 High Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) Plugin azon-addon-js-composer SQL Injection ≤ 1.2 CVE-2025-30628 Patchstack
6.5 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting ≤ 3.9.2 CVE-2025-62990 Patchstack
6.5 Medium Web and WooCommerce Addons for WPBakery Builder Plugin vc-addons-by-bit14 Cross-Site Scripting ≤ 1.5 CVE-2025-62748 Patchstack
7.5 High Knowband Mobile App Builder for wooCommerce Plugin Broken Access Control Unauthenticated Arbitrary User Deletion No login needed < 3.0.0 Fixed in 3.0.0 CVE-2025-13029 WPScan
4.3 Medium PopupKit Plugin popup-builder-block Information Disclosure Sensitive Data Exposure ≤ 2.1.5 Fixed in 2.2.1 CVE-2025-69026 Patchstack
9.8 Critical Mobile builder Plugin mobile-builder Authentication Bypass Broken Authentication No login needed ≤ 1.4.2 CVE-2025-68860 Patchstack
6.5 Medium Page Builder: Live Composer Plugin live-composer-page-builder Cross-Site Scripting ≤ 2.1.22 CVE-2025-68598 Patchstack
5.4 Medium YITH Slider for page builders Plugin yith-slider-for-page-builders Broken Access Control ≤ 1.0.11 CVE-2025-68581 Patchstack
6.5 Medium WC Builder Plugin wc-builder Cross-Site Scripting ≤ 1.2.0 Fixed in 1.2.1 CVE-2025-68533 Patchstack
5.3 Medium Brave Plugin brave-popup-builder Broken Access Control No login needed ≤ 0.8.3 Fixed in 0.8.4 CVE-2025-68508 Patchstack
8.1 High Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update ≤ 2.9.4.1 CVE-2025-12934 Wordfence
6.5 Medium Void Elementor WHMCS Elements For Elementor Page Builder Plugin void-elementor-whmcs-elements Cross-Site Scripting ≤ 2.0.1.2 CVE-2025-62094 Patchstack
4.4 Medium WC Builder Plugin wc-builder Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute ≤ 1.2.0 CVE-2025-14054 Wordfence
7.5 High Live Composer – Free WordPress Website Builder Plugin live-composer-page-builder PHP Object Injection Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode ≤ 2.0.2 CVE-2025-14071 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.345 CVE-2025-11747 Wordfence
8.8 High PDF for Elementor Forms + Drag And Drop Template Builder Plugin pdf-for-elementor-forms PHP Object Injection ≤ 6.5.0 Fixed in 6.5.1 CVE-2025-60084 Patchstack
8.8 High PDF Invoice Builder for WooCommerce Plugin pdf-for-woocommerce PHP Object Injection Deserialization of untrusted data ≤ 6.5.0 Fixed in 6.5.1 CVE-2025-60083 Patchstack
7.5 High PDF for Gravity Forms + Drag And Drop Template Builder Plugin pdf-for-gravity-forms PHP Object Injection ≤ 6.5.0 Fixed in 6.5.1 CVE-2025-60080 Patchstack
8.5 High PopupKit Plugin popup-builder-block SQL Injection ≤ 2.1.5 Fixed in 2.2.0 CVE-2025-14314 Patchstack
6.4 Medium Live Composer – Free WordPress Website Builder Plugin live-composer-page-builder Cross-Site Scripting Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.0.2 CVE-2025-13537 Wordfence
7.5 High Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Broken Access Control The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token No login needed ≤ 3.13.2 CVE-2025-11924 Wordfence
4.3 Medium SKT Page Builder Plugin skt-builder Broken Access Control ≤ 4.9 Fixed in 5.0 CVE-2025-54005 Patchstack
5.3 Medium JetFormBuilder Plugin jetformbuilder Broken Access Control Missing Authorization to Unauthenticated Form Generation No login needed ≤ 3.5.3 CVE-2025-11991 Wordfence
6.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode ≤ 6.0.6.7 CVE-2025-13610 Wordfence
6.4 Medium User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Plugin user-registration Cross-Site Scripting Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.4.6 CVE-2025-13367 Wordfence
6.4 Medium Addon Elements for Elementor Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.14.3 CVE-2025-12537 Wordfence
6.4 Medium Popup Builder – Create highly converting, mobile friendly marketing popups. Plugin popup-builder Cross-Site Scripting Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.4.1 CVE-2025-9856 Wordfence
6.5 Medium Brizy – Page Builder Plugin brizy Information Disclosure Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function ≤ 2.7.16 CVE-2025-0969 Wordfence
5.4 Medium Popup Builder Plugin easy-notify-lite Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset ≤ 1.1.37 CVE-2025-14446 Wordfence
8.1 High Extensive VC Addons for WPBakery page builder Plugin extensive-vc-addon Local File Inclusion Unauthenticated Local File Inclusion via 'shortcode_name' Parameter No login needed ≤ 1.9.1 CVE-2025-14475 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.335 CVE-2025-11376 Wordfence
4.3 Medium PDF for Contact Form 7 + Drag and Drop Template Builder Plugin pdf-for-contact-form-7 Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication ≤ 6.3.3 CVE-2025-14074 Wordfence
7.5 High FunnelKit – Funnel Builder for WooCommerce Checkout Plugin funnel-builder SQL Injection Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection No login needed ≤ 3.13.1.5 CVE-2025-14169 Wordfence
6.4 Medium App Landing Template Blocks for WPBakery Page Builder Plugin app-template-blocks-for-wpbakery-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 2.0.2 CVE-2025-14119 Wordfence
4.3 Medium Elementor Website Builder Plugin elementor Broken Access Control ≤ 3.33.0 Fixed in 3.33.1 CVE-2025-67588 Patchstack
5.3 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control No login needed ≤ 3.8.20 Fixed in 3.8.21 CVE-2025-67577 Patchstack
4.3 Medium Chartify Plugin chart-builder Cross-Site Request Forgery No login needed ≤ 3.6.3 Fixed in 3.6.4 CVE-2025-66529 Patchstack
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Information Disclosure WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure ≤ 2.9.4 CVE-2025-12558 Wordfence
4.3 Medium Webcake – Landing Page Builder Plugin webcake Broken Access Control Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 1.1 CVE-2025-12165 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering ≤ 2.9.4 CVE-2025-12782 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification ≤ 2.9.4 CVE-2025-11726 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only