Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

337,660

All time

Critical · Active

10,701

CVSS ≥ 9.0

New · 14 days

2,142

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 4471–4500 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-58678	medium	6.5/10	WordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58680	medium	6.5/10	WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58682	medium	6.5/10	WordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58681	medium	5.3/10	WordPress Easy Quotes Plugin <= 1.2.4 - Broken Access Control Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58683	medium	6.5/10	WordPress Last Updated Shortcode Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58684	medium	6.5/10	WordPress Logo Showcase plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58686	high	8.5/10	WordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58685	medium	5.3/10	WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58687	high	7.1/10	WordPress Current Age Plugin Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58688	high	7.1/10	WordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58689	medium	6.5/10	WordPress Tapfiliate Plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58691	medium	6.5/10	WordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58690	high	7.1/10	WordPress Doliconnect Plugin <= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58702	medium	6.5/10	WordPress MarketKing Plugin <= 2.0.92 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58703	medium	6.5/10	WordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58704	medium	6.5/10	WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-10489	medium	4.3/10	SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation	Sep 20, 2025 9mo ago
CVE-2025-10690	critical	9.8/10	Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation	Sep 19, 2025 9mo ago
CVE-2025-8565	high	8.1/10	Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation	Sep 18, 2025 9mo ago
CVE-2025-9216	high	8.8/10	StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload	Sep 17, 2025 9mo ago
CVE-2025-9215	medium	6.5/10	StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download	Sep 17, 2025 9mo ago
CVE-2025-10057	high	8.8/10	WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection	Sep 17, 2025 9mo ago
CVE-2025-10058	high	8.1/10	WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion	Sep 17, 2025 9mo ago
CVE-2025-9776	medium	6.5/10	CatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import	Sep 11, 2025 10mo ago
CVE-2025-7718	high	8.8/10	Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover	Sep 10, 2025 10mo ago
CVE-2025-10001	high	7.2/10	Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload	Sep 10, 2025 10mo ago
CVE-2025-10040	high	7.7/10	WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure	Sep 10, 2025 10mo ago
CVE-2025-7049	high	8.8/10	WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover	Sep 10, 2025 10mo ago
CVE-2025-58976	medium	4.3/10	WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability	Sep 9, 2025 10mo ago
CVE-2025-58975	medium	4.3/10	WordPress Advanced Settings Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 9, 2025 10mo ago