Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

337,672

All time

Critical · Active

10,701

CVSS ≥ 9.0

New · 14 days

2,000

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 4531–4560 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-39553	medium	4.3/10	WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47569	critical	9.3/10	WordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47437	medium	6.4/10	WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47571	high	7.5/10	WordPress Super Store Finder plugin < 7.8 - Local File Inclusion vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47570	high	7.1/10	WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47579	critical	9.0/10	WordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47695	high	7.5/10	WordPress Blog Designer PRO plugin <= 3.4.7 - Authenticated Non-Arbitrary Local File Inclusion vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47694	high	7.1/10	WordPress Blog Designer PRO plugin <= 3.4.7 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 9, 2025 10mo ago
CVE-2025-49860	medium	5.3/10	WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability	Sep 9, 2025 10mo ago
CVE-2025-59005	medium	4.3/10	WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability	Sep 9, 2025 10mo ago
CVE-2025-59008	high	7.6/10	WordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerability	Sep 9, 2025 10mo ago
CVE-2025-10134	critical	9.1/10	Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion	Sep 9, 2025 10mo ago
CVE-2025-9539	high	8.0/10	AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation	Sep 9, 2025 10mo ago
CVE-2025-27003	medium	4.3/10	WordPress Quick Paypal Payments Plugin <= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerability	Sep 5, 2025 10mo ago
CVE-2025-53571	medium	6.5/10	WordPress HAPPY plugin <= 1.0.6 - Broken Access Control vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58206	high	8.1/10	WordPress MaxCoach Theme <= 3.2.5 - Local File Inclusion Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58214	high	8.1/10	WordPress Indutri Theme < 1.3.0 - Local File Inclusion Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58628	critical	9.3/10	WordPress Miraculous Theme < 2.0.9 - SQL Injection Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-48102	medium	5.9/10	WordPress GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability	Sep 5, 2025 10mo ago
CVE-2025-48104	high	7.1/10	WordPress Floating Window Music Player plugin <= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Sep 5, 2025 10mo ago
CVE-2025-48103	medium	6.5/10	WordPress Today's Date Inserter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability	Sep 5, 2025 10mo ago
CVE-2025-48317	high	7.5/10	WordPress WooCommerce Payment Gateway for Saferpay Plugin <= 0.4.9 - Path Traversal Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-48105	medium	6.5/10	WordPress Easy Flash Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	Sep 5, 2025 10mo ago
CVE-2025-53307	high	7.1/10	WordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-49401	critical	9.8/10	WordPress smart SEO Plugin <= 4.0 - Privilege Escalation Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-54744	medium	6.5/10	WordPress MasterStudy LMS plugin <= 3.6.15 - Broken Access Control vulnerability	Sep 5, 2025 10mo ago
CVE-2025-57889	high	7.5/10	WordPress InPost Gallery Plugin <= 2.1.4.5 - Local File Inclusion Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58887	medium	6.5/10	WordPress Course Booking Platform Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58886	medium	5.9/10	WordPress Instant Locations Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58884	medium	5.9/10	WordPress vipdrv Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability	Sep 5, 2025 10mo ago