Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,525

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,106

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 3781–3810 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-49371	high	8.1/10	WordPress Strux theme <= 1.9 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49370	high	8.1/10	WordPress Lymcoin theme <= 1.3.12 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49369	high	8.1/10	WordPress Lettuce theme <= 1.1.7 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49368	high	8.1/10	WordPress Palladio theme <= 1.1.10 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49367	high	8.1/10	WordPress Monyxi theme <= 1.1.8 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49366	high	8.1/10	WordPress Hanani theme <= 1.2.11 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49365	high	8.1/10	WordPress Jack Well theme <= 1.0.14 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49364	high	8.1/10	WordPress Ludos Paradise theme <= 2.1.3 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49363	high	8.1/10	WordPress Kings & Queens theme <= 1.1.16 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49362	high	8.1/10	WordPress Gracioza theme <= 1.0.15 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49361	high	8.1/10	WordPress Mamita theme <= 1.0.9 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49360	high	8.1/10	WordPress Militarology theme <= 1.0.15 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49359	high	8.1/10	WordPress ShieldGroup theme <= 2.13 - Local File Inclusion vulnerability	Dec 18, 2025 8mo ago
CVE-2025-49041	medium	6.5/10	WordPress Get Cash plugin <= 3.2.3 - Broken Access Control vulnerability	Dec 18, 2025 8mo ago
CVE-2025-14314	high	8.5/10	WordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerability	Dec 18, 2025 8mo ago
CVE-2025-10019	medium	6.5/10	WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability	Dec 18, 2025 8mo ago
CVE-2025-13537	medium	6.4/10	Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Dec 17, 2025 8mo ago
CVE-2025-14154	medium	6.1/10	Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting	Dec 17, 2025 8mo ago
CVE-2025-13861	medium	6.1/10	HTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting	Dec 17, 2025 8mo ago
CVE-2025-13231	medium	6.5/10	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition	Dec 16, 2025 8mo ago
CVE-2025-68088	medium	5.4/10	WordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68087	medium	5.4/10	WordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68086	medium	5.4/10	WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68085	medium	5.4/10	WordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68084	medium	5.4/10	WordPress Ultimate Auction plugin <= 4.3.3 - Broken Access Control vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68083	medium	5.4/10	WordPress Meks Quick Plugin Disabler plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68082	medium	5.4/10	WordPress Semrush Content Toolkit plugin <= 1.1.32 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68080	medium	6.5/10	WordPress User Avatar - Reloaded plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68079	medium	6.5/10	WordPress Salient Shortcodes plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2025 8mo ago
CVE-2025-68078	medium	6.5/10	WordPress Salient Portfolio theme <= 1.8.2 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2025 8mo ago