Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

337,414

All time

Critical · Active

10,677

CVSS ≥ 9.0

New · 14 days

1,985

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 3691–3720 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-39463	high	7.5/10	WordPress Dessau theme < 1.9 - Local File Inclusion vulnerability	Nov 6, 2025 8mo ago
CVE-2025-32222	critical	9.9/10	WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability	Nov 6, 2025 8mo ago
CVE-2025-31029	high	7.1/10	WordPress replyMail plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability	Nov 6, 2025 8mo ago
CVE-2025-28953	high	8.5/10	WordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerability	Nov 6, 2025 8mo ago
CVE-2025-22288	medium	4.1/10	WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability	Nov 6, 2025 8mo ago
CVE-2025-12469	medium	4.3/10	FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending	Nov 5, 2025 8mo ago
CVE-2025-12468	medium	5.3/10	FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure	Nov 5, 2025 8mo ago
CVE-2025-12139	high	7.5/10	File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure	Nov 5, 2025 8mo ago
CVE-2025-12580	medium	6.1/10	SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting	Nov 5, 2025 8mo ago
CVE-2025-11753	medium	4.4/10	Multi-language Responsive Portfolio WordPress <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting	Nov 4, 2025 8mo ago
CVE-2025-12324	medium	6.4/10	TablePress – Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	Nov 4, 2025 8mo ago
CVE-2025-64294	medium	5.3/10	WordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerability	Nov 3, 2025 8mo ago
CVE-2025-12137	medium	4.9/10	Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read	Nov 1, 2025 8mo ago
CVE-2025-11816	medium	5.3/10	Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect	Nov 1, 2025 8mo ago
CVE-2025-64368	medium	5.4/10	WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64367	medium	6.5/10	WordPress Groundhogg plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64366	high	7.6/10	WordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64365	medium	6.5/10	WordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64364	high	7.5/10	WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64363	high	7.5/10	WordPress Kleo theme < 5.5.0 - Local File Inclusion vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64362	medium	6.5/10	WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64361	medium	6.5/10	WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64360	high	7.5/10	WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64359	high	7.5/10	WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64358	medium	4.3/10	WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64357	medium	4.3/10	WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64356	medium	4.3/10	WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64354	medium	6.5/10	WordPress Gutenberg plugin <= 21.8.2 - Cross Site Scripting (XSS) vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64353	high	8.8/10	WordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerability	Oct 31, 2025 8mo ago
CVE-2025-64352	low	2.7/10	WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerability	Oct 31, 2025 8mo ago