Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

337,843

All time

Critical · Active

10,721

CVSS ≥ 9.0

New · 14 days

2,161

Newly disclosed

Feed last synced

31 mins ago

Data freshness

Showing 4741–4770 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-53243	high	8.1/10	WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53230	high	7.6/10	WordPress Page Manager for Elementor Plugin <= 2.0.5 - Broken Access Control Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53227	high	8.1/10	WordPress Magazine Saga Theme <= 1.2.7 - Local File Inclusion Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53225	high	7.1/10	WordPress e-Boekhouden.nl Plugin <= 1.9.3 - Cross Site Scripting (XSS) Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53224	high	7.1/10	WordPress NextGEN Gallery Search Plugin <= 2.12 - Cross Site Scripting (XSS) Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53223	high	7.1/10	WordPress Theme Switcher Reloaded Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53220	high	7.1/10	WordPress XmasB Quotes Plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53216	high	8.1/10	WordPress Glamer Theme <= 1.0.2 - Local File Inclusion Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-53215	high	7.1/10	WordPress Yahoo! WebPlayer Plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-52761	critical	9.8/10	WordPress WP Funnel Manager Plugin <= 1.4.0 - PHP Object Injection Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-49407	high	8.8/10	WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-49405	medium	4.3/10	WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-49404	high	8.5/10	WordPress Listeo-Core Plugin < 2.0.7 - SQL Injection Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-49402	high	8.5/10	WordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-49388	critical	9.8/10	WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-49387	critical	10.0/10	WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-49383	high	8.1/10	WordPress Neresa Theme <= 1.3 - Local File Inclusion Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48365	medium	5.9/10	WordPress Custom Comment plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48364	medium	4.9/10	WordPress rajce plugin <= 0.4.2 - Server Side Request Forgery (SSRF) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48363	medium	4.3/10	WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48362	medium	5.4/10	WordPress Hesabfa Accounting plugin <= 2.2.5 - Cross Site Request Forgery (CSRF) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48361	medium	5.3/10	WordPress Hesabfa Accounting plugin <= 2.2.5 - Sensitive Data Exposure via Log File vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48360	medium	5.9/10	WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48359	high	7.1/10	WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48358	medium	5.9/10	WordPress Risk Free Cash On Delivery (COD) – WooCommerce plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48357	medium	5.4/10	WordPress Century ToolKit plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Activation vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48356	medium	6.5/10	WordPress Kanpress plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48354	medium	6.5/10	WordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48353	high	7.1/10	WordPress Clickbank WordPress Plugin (Niche Storefront) plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48352	medium	5.9/10	WordPress Yandex Site search pinger plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 10mo ago