Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,528

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,109

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 4351–4380 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-48086	medium	5.5/10	WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability	Nov 6, 2025 9mo ago
CVE-2025-48085	high	7.1/10	WordPress Simple Stripe plugin <= 0.9.17 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Nov 6, 2025 9mo ago
CVE-2025-48083	high	7.1/10	WordPress wpNamedUsers plugin <= 0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Nov 6, 2025 9mo ago
CVE-2025-48078	high	7.1/10	WordPress Slick Google Map plugin <= 0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Nov 6, 2025 9mo ago
CVE-2025-48077	high	7.1/10	WordPress Block Country plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Nov 6, 2025 9mo ago
CVE-2025-47588	critical	9.1/10	WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerability	Nov 6, 2025 9mo ago
CVE-2025-39468	high	8.1/10	WordPress Modal Survey plugin <= 2.0.2.0.1 - Local File Inclusion vulnerability	Nov 6, 2025 9mo ago
CVE-2025-39467	high	8.1/10	WordPress Wanderland theme <= 1.7.1 - Local File Inclusion Vulnerability	Nov 6, 2025 9mo ago
CVE-2025-39466	high	8.1/10	WordPress Dør theme <= 2.4 - Local File Inclusion Vulnerability	Nov 6, 2025 9mo ago
CVE-2025-39465	medium	4.3/10	WordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerability	Nov 6, 2025 9mo ago
CVE-2025-39463	high	7.5/10	WordPress Dessau theme < 1.9 - Local File Inclusion vulnerability	Nov 6, 2025 9mo ago
CVE-2025-32222	critical	9.9/10	WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability	Nov 6, 2025 9mo ago
CVE-2025-31029	high	7.1/10	WordPress replyMail plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability	Nov 6, 2025 9mo ago
CVE-2025-28953	high	8.5/10	WordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerability	Nov 6, 2025 9mo ago
CVE-2025-22288	medium	4.1/10	WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability	Nov 6, 2025 9mo ago
CVE-2025-12469	medium	4.3/10	FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending	Nov 5, 2025 10mo ago
CVE-2025-12468	medium	5.3/10	FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure	Nov 5, 2025 10mo ago
CVE-2025-12139	high	7.5/10	File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure	Nov 5, 2025 10mo ago
CVE-2025-12580	medium	6.1/10	SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting	Nov 5, 2025 10mo ago
CVE-2025-11753	medium	4.4/10	Multi-language Responsive Portfolio WordPress <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting	Nov 4, 2025 10mo ago
CVE-2025-12324	medium	6.4/10	TablePress – Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	Nov 4, 2025 10mo ago
CVE-2025-64294	medium	5.3/10	WordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerability	Nov 3, 2025 10mo ago
CVE-2025-12137	medium	4.9/10	Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read	Nov 1, 2025 10mo ago
CVE-2025-11816	medium	5.3/10	Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect	Nov 1, 2025 10mo ago
CVE-2025-64368	medium	5.4/10	WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability	Oct 31, 2025 10mo ago
CVE-2025-64367	medium	6.5/10	WordPress Groundhogg plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability	Oct 31, 2025 10mo ago
CVE-2025-64366	high	7.6/10	WordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerability	Oct 31, 2025 10mo ago
CVE-2025-64365	medium	6.5/10	WordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability	Oct 31, 2025 10mo ago
CVE-2025-64364	high	7.5/10	WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability	Oct 31, 2025 10mo ago
CVE-2025-64363	high	7.5/10	WordPress Kleo theme < 5.5.0 - Local File Inclusion vulnerability	Oct 31, 2025 10mo ago