Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

337,538

All time

Critical · Active

10,688

CVSS ≥ 9.0

New · 14 days

2,064

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 4081–4110 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-30944	high	7.5/10	WordPress Tablesome Table Premium <= 1.1.23 - Broken Access Control Vulnerability	Oct 22, 2025 8mo ago
CVE-2025-11372	medium	6.5/10	LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation	Oct 18, 2025 8mo ago
CVE-2025-10187	medium	4.9/10	GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection	Oct 18, 2025 8mo ago
CVE-2025-48087	medium	6.5/10	WordPress Memberlite Shortcodes plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Oct 17, 2025 8mo ago
CVE-2025-10313	high	7.2/10	Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting	Oct 15, 2025 8mo ago
CVE-2025-6042	high	7.3/10	Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Unauthenticated Privilege Escalation to Editor	Oct 15, 2025 8mo ago
CVE-2011-10033	critical	9.3/10	WordPress Plugin is-human <= v1.4.2 Eval Injection RCE	Oct 15, 2025 8mo ago
CVE-2025-10732	medium	4.3/10	SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure	Oct 14, 2025 8mo ago
CVE-2025-10129	medium	6.4/10	WordPress Live Webcam Widget & Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Oct 11, 2025 9mo ago
CVE-2025-10185	medium	4.9/10	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection	Oct 11, 2025 9mo ago
CVE-2025-11522	critical	9.8/10	Search & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover	Oct 9, 2025 9mo ago
CVE-2025-6038	high	8.8/10	Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation	Oct 9, 2025 9mo ago
CVE-2025-11171	medium	5.3/10	Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function	Oct 8, 2025 9mo ago
CVE-2025-9858	medium	6.4/10	Auto Bulb Finder for WordPress <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Oct 3, 2025 9mo ago
CVE-2025-9946	medium	6.1/10	LockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting	Sep 30, 2025 9mo ago
CVE-2025-8623	medium	6.4/10	WeedMaps Menu for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode	Sep 30, 2025 9mo ago
CVE-2025-9993	high	8.1/10	Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion	Sep 30, 2025 9mo ago
CVE-2025-60219	critical	10.0/10	WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60186	medium	5.9/10	WordPress Google+ Comments Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60185	medium	5.9/10	WordPress kontur Admin Style Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60184	medium	5.9/10	WordPress SEO Search Permalink Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60181	medium	5.4/10	WordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60179	medium	5.9/10	WordPress Click & Tweet Plugin <= 0.8.9 - Cross Site Scripting (XSS) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60177	medium	5.9/10	WordPress Recaptcha – wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60173	high	7.1/10	WordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60172	high	7.1/10	WordPress Flytedesk Digital Plugin <= 20181101 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60171	high	7.1/10	WordPress Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60170	high	7.1/10	WordPress HTACCESS IP Blocker Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60169	high	7.1/10	WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60167	medium	4.3/10	WordPress Page Manager for Elementor Plugin <= 2.0.5 - Sensitive Data Exposure Vulnerability	Sep 26, 2025 9mo ago