WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress security

The most targeted web platform

WordPress powers over 40% of all websites, which makes it the most targeted platform on the web. WordPress core is actively maintained and gets automatic security updates for minor releases. Core itself has relatively few CVEs each year. The real risk is in plugins and themes. There are over 60,000 plugins in the official directory, built by many different developers with varying security practices. One vulnerable plugin installed across millions of sites can be actively exploited within hours of a CVE going public.

The most common vulnerability types in the WordPress ecosystem are cross-site scripting (XSS), SQL injection, broken access control, cross-site request forgery (CSRF), PHP object injection, and unrestricted file upload. XSS and access control failures account for most WordPress CVEs. They are usually found in plugin code that processes user input without proper sanitisation or permission checks.

This database tracks every CVE that affects WordPress core, plugins, themes, and page builders including Elementor, Divi, WPBakery, and Beaver Builder. Records come from the official NVD feed and are updated continuously.

Triage and remediation

From CVE to fix

Search by plugin name, theme name, or vendor to filter the list down to what you care about. Click any CVE ID to open the full record: CVSS score breakdown, affected version range, disclosure dates, and a link to the original NVD entry.

If a plugin or theme on one of your sites shows up here with a Critical or High rating and your installed version is within the affected range, update or remove it right away. Most WordPress plugin vulnerabilities are patched within days of CVE assignment. Check the plugin changelog for a security release newer than the affected range. If the plugin has been abandoned or removed from WordPress.org, removal is the only safe option.