Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

WordPress security records

WordPress Vulnerability Listing

Filter Production Feed records and inspect affected software, version ranges, severity, patch information and source attribution without opening separate UUID pages.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

Clear filters

9 vulnerability records

MediumCVE-2026-2951

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.5.5

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.5.5

Patched versions: 3.5.6

Researcher credit: Muhammad Yudha - DJ

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
April 22, 2026
CVSS
5.4
MediumCVE-2025-58680

Gutentor <= 3.5.2 - Missing Authorization

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.5.2

Vulnerability type: CWE-862 Missing Authorization

Affected software, patched versions and attribution

The Gutentor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.5.2. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.5.2

Patched versions: 3.5.3

Researcher credit: n0_arafat_n0

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
September 22, 2025
CVSS
5.4
MediumCVE-2025-58783

Gutentor <= 3.5.5 - Missing Authorization

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.5.5

Vulnerability type: CWE-862 Missing Authorization

Affected software, patched versions and attribution

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.5.5

Patched versions: 3.5.6

Researcher credit: Denver Jackson

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
September 5, 2025
CVSS
4.3
MediumCVE-2025-4685

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.4.8

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgets, in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.4.8

Patched versions: 3.4.9

Researcher credit: Webbernaut

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 20, 2025
CVSS
6.4
MediumCVE-2024-5647

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library

Bold Page Builder: Currently marked unpatchedDivi Builder: Currently marked unpatchedDivi: Currently marked unpatchedOceanWP: Currently marked unpatchedRobo Gallery – Photo & Image Slider: Currently marked unpatchedHappy Addons for Elementor: Currently marked unpatchedDivi Extra: Currently marked unpatchedSupreme Modules Lite – Divi Theme, Extra Theme and Divi Builder: Currently marked unpatchedShortcodes Ultimate – Content Elements: Currently marked unpatchedBlossomThemes Social Feed: Currently marked unpatchedCarousel Slider: Currently marked unpatchedDivi Torque Lite – Divi Modules for the Divi Builder & Theme: Currently marked unpatchedGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatchedEssential Addons for Elementor – Popular Elementor Templates & Widgets: Currently marked unpatched

Affected versions: *-5.1.2; *-4.27.1; *-4.27.1; *-3.6.0; *-3.2.22; *-3.12.2; *-4.27.1; *-2.5.52

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.

Bold Page Builder

Affected versions: *-5.1.2

Patched versions: 5.1.3

Divi Builder

Affected versions: *-4.27.1

Patched versions: 4.27.2

Divi

Affected versions: *-4.27.1

Patched versions: 4.27.2

OceanWP

Affected versions: *-3.6.0

Patched versions: 3.6.1

Robo Gallery – Photo & Image Slider

Affected versions: *-3.2.22

Patched versions: 3.2.23

Happy Addons for Elementor

Affected versions: *-3.12.2

Patched versions: 3.12.3

Divi Extra

Affected versions: *-4.27.1

Patched versions: 4.27.2

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder

Affected versions: *-2.5.52

Patched versions: 2.5.53

Shortcodes Ultimate – Content Elements

Affected versions: *-7.4.2

Patched versions: 7.4.3

BlossomThemes Social Feed

Affected versions: *-2.0.5

Patched versions: Not supplied

Carousel Slider

Affected versions: *-2.2.14

Patched versions: 2.2.15

Divi Torque Lite – Divi Modules for the Divi Builder & Theme

Affected versions: *-4.0.5

Patched versions: 4.0.6

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.4.9

Patched versions: Not supplied

Essential Addons for Elementor – Popular Elementor Templates & Widgets

Affected versions: *-6.0.4

Patched versions: 6.0.5

Researcher credit: Webbernaut

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 2, 2025
CVSS
6.4
MediumCVE-2025-1986

Gutentor <= 3.4.6 - Authenticated (Administrator+) SQL Injection

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.4.6

Vulnerability type: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected software, patched versions and attribution

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.4.6

Patched versions: 3.4.7

Researcher credit: Greshow

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
March 11, 2025
CVSS
4.9
MediumCVE-2025-22293

Gutentor <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.4.3

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Gutentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.4.3

Patched versions: 3.4.4

Researcher credit: João Pedro Soares de Alcântara

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
January 6, 2025
CVSS
6.4
MediumCVE-2024-10178

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.3.9

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.3.9

Patched versions: 3.4.0

Researcher credit: Webbernaut

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
December 4, 2024
CVSS
6.4
MediumCVE-2024-43308

Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Currently marked unpatched

Affected versions: *-3.3.5

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-5417 may be a duplicate of this issue.

Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor

Affected versions: *-3.3.5

Patched versions: 3.3.6

Researcher credit: João Pedro Soares de Alcântara

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
August 16, 2024
CVSS
6.4

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

Production Feed records are aggregated without claiming discovery, exploitation or infection. Applicable source notices remain attached to individual records. Read the methodology.