Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

337,300

All time

Critical · Active

10,667

CVSS ≥ 9.0

New · 14 days

1,883

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 3331–3360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-67597	medium	4.3/10	WordPress Fluent Booking plugin <= 1.9.11 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67596	medium	4.3/10	WordPress Business Directory plugin <= 6.4.19 - Cross Site Request Forgery (CSRF) vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67595	medium	4.3/10	WordPress Quiz Maker plugin <= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67594	medium	4.3/10	WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67593	medium	4.3/10	WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67592	medium	4.3/10	WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67591	medium	4.3/10	WordPress JNews Paywall plugin < 12.0.1 - Cross Site Request Forgery (CSRF) vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67590	medium	4.3/10	WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67589	medium	4.3/10	WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67588	medium	4.3/10	WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67587	medium	4.7/10	WordPress WP Gravity Forms FreshDesk Plugin plugin <= 1.3.5 - Open Redirection vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67586	medium	4.7/10	WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67585	medium	4.7/10	WordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67584	medium	5.3/10	WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67583	medium	5.3/10	WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67582	medium	5.3/10	WordPress Wbcom Designs plugin <= 2.1.1 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67581	medium	5.3/10	WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67580	medium	5.3/10	WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67579	medium	5.3/10	WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67578	medium	5.3/10	WordPress WP Email Capture plugin <= 3.12.4 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67577	medium	5.3/10	WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67576	medium	5.3/10	WordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67575	medium	5.3/10	WordPress Sitewide Notice WP plugin <= 2.4.1 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67574	medium	5.3/10	WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67573	medium	5.3/10	WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67572	medium	5.3/10	WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67571	medium	5.3/10	WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67570	medium	5.3/10	WordPress WPForms Google Sheet Connector plugin <= 4.0.0 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67569	medium	5.3/10	WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago
CVE-2025-67568	medium	5.3/10	WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerability	Dec 9, 2025 6mo ago