Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

337,445

All time

Critical · Active

10,679

CVSS ≥ 9.0

New · 14 days

2,008

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 3841–3870 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-62903	medium	6.5/10	WordPress WPC Smart Messages for WooCommerce plugin <= 4.2.8 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62902	medium	5.3/10	WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62900	medium	6.5/10	WordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62899	medium	5.9/10	WordPress Photospace Responsive plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62898	medium	6.5/10	WordPress Links shortcode plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62897	medium	5.3/10	WordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62896	high	7.1/10	WordPress Multilang Contact Form plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62895	medium	5.3/10	WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62894	medium	6.5/10	WordPress ACF Recent Posts Widget plugin <= 5.9.3 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62892	medium	5.3/10	WordPress Sunshine Photo Cart plugin <= 3.5.3 - Broken Access Control vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62891	medium	4.3/10	WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62890	medium	4.3/10	WordPress Premmerce Brands for WooCommerce plugin <= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62889	medium	6.5/10	WordPress King Addons for Elementor plugin <= 51.1.61 - Broken Access Control vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62887	medium	6.5/10	WordPress King Addons for Elementor plugin <= 51.1.61 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62886	high	7.1/10	WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62885	medium	6.5/10	WordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62884	medium	5.3/10	WordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62883	medium	4.3/10	WordPress Premmerce User Roles plugin <= 1.0.13 - Broken Access Control vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62882	medium	4.3/10	WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62881	medium	4.3/10	WordPress WP-Lister Lite for eBay plugin <= 3.8.3 - Broken Access Control vulnerability	Oct 27, 2025 8mo ago
CVE-2025-11897	medium	6.4/10	The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'	Oct 25, 2025 8mo ago
CVE-2025-11976	medium	4.3/10	FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation	Oct 25, 2025 8mo ago
CVE-2025-8483	medium	6.3/10	Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution	Oct 25, 2025 8mo ago
CVE-2025-10580	medium	6.4/10	Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Oct 25, 2025 8mo ago
CVE-2025-11893	medium	6.5/10	Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection	Oct 25, 2025 8mo ago
CVE-2025-12005	medium	4.3/10	WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update	Oct 25, 2025 8mo ago
CVE-2025-10749	medium	5.4/10	Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion	Oct 24, 2025 8mo ago
CVE-2025-10701	medium	6.4/10	Time Clock – A WordPress Employee & Volunteer Time Clock Plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scripting	Oct 24, 2025 8mo ago
CVE-2025-10740	medium	6.3/10	URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation	Oct 24, 2025 8mo ago
CVE-2025-62868	high	8.1/10	WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability	Oct 24, 2025 8mo ago