Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

352,608

All time

Critical · Active

12,475

CVSS ≥ 9.0

New · 14 days

1,097

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 4321–4350 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-60190	high	8.1/10	WordPress Immocaster WordPress Plugin plugin <= 1.3.6 - Local File Inclusion vulnerability	Nov 6, 2025 10mo ago
CVE-2025-60189	high	7.5/10	WordPress PoloPag – Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion vulnerability	Nov 6, 2025 10mo ago
CVE-2025-60188	high	7.5/10	WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability	Nov 6, 2025 10mo ago
CVE-2025-60187	medium	4.8/10	WordPress Atarim plugin <= 4.2.1 - Arbitrary File Upload vulnerability	Nov 6, 2025 10mo ago
CVE-2025-60074	high	7.5/10	WordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerability	Nov 6, 2025 10mo ago
CVE-2025-60073	high	7.5/10	WordPress Responsive Sidebar plugin <= 1.2.2 - Local File Inclusion vulnerability	Nov 6, 2025 10mo ago
CVE-2025-59556	high	7.1/10	WordPress GoStore theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58998	critical	9.8/10	WordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58996	critical	9.1/10	WordPress Advanced Settings Plugin <= 3.1.1 - Arbitrary File Upload Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58995	high	8.1/10	WordPress Leblix Theme <= 2.4 - Local File Inclusion Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58994	high	8.1/10	WordPress Greenify theme <= 2.2 - Local File Inclusion vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58986	medium	6.5/10	WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58972	high	7.2/10	WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.10.4 - Path Traversal vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58964	high	7.1/10	WordPress Enzy theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58638	high	7.1/10	WordPress Institutions Directory Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58636	critical	9.8/10	WordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58629	high	7.5/10	WordPress Miraculous theme < 2.0.9 - Arbitrary Content Deletion vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58627	critical	9.8/10	WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58619	high	8.8/10	WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58595	medium	5.3/10	WordPress All In One Login plugin <= 2.0.8 - Bypass Vulnerability vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58592	high	8.1/10	WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58243	medium	5.3/10	WordPress imEvent Theme <= 3.4.0 - Broken Access Control Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-58207	high	8.2/10	WordPress Ai Image Alt Text Generator for WP Plugin <= 1.1.5 - Broken Access Control Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-5803	medium	5.3/10	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerability	Nov 6, 2025 10mo ago
CVE-2025-54737	high	7.1/10	WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-54722	high	7.1/10	WordPress WooTour plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-54721	high	7.1/10	WordPress Resca theme <= 3.0.2 - Cross Site Scripting (XSS) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-54719	high	8.8/10	WordPress Yogi - Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data Vulnerability	Nov 6, 2025 10mo ago
CVE-2025-54718	high	7.1/10	WordPress Yogi - Health Beauty & Yoga theme <= 2.9.2 - Cross Site Scripting (XSS) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-54711	high	7.1/10	WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability	Nov 6, 2025 10mo ago