Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,837

All time

Critical · Active

12,642

CVSS ≥ 9.0

New · 14 days

1,496

Newly disclosed

Feed last synced

56 mins ago

Data freshness

Showing 421–450 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-65556	critical	9.8/10	WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65554	high	7.1/10	WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65553	critical	10.0/10	WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65552	critical	9.8/10	WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65549	high	7.2/10	WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65548	critical	9.9/10	WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65547	high	8.5/10	WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65546	critical	9.3/10	WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65545	high	7.1/10	WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65544	high	7.1/10	WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65543	high	7.5/10	WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65542	high	8.8/10	WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65541	high	7.3/10	WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65523	high	7.5/10	WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65520	critical	9.3/10	WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65517	high	7.1/10	WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65515	high	7.1/10	WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65513	high	7.1/10	WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65509	high	7.1/10	WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65508	critical	9.3/10	WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65507	critical	9.8/10	WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65504	high	7.5/10	WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65502	medium	5.3/10	WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability	Aug 6, 2026 2mo ago
CVE-2026-61982	high	7.1/10	WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-61964	high	7.1/10	WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-61963	high	7.1/10	WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-61961	high	7.1/10	WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-61959	medium	6.5/10	WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-32548	medium	5.3/10	WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-32469	medium	5.3/10	WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability	Aug 6, 2026 2mo ago