Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

352,656

All time

Critical · Active

12,481

CVSS ≥ 9.0

New · 14 days

1,124

Newly disclosed

Feed last synced

35 mins ago

Data freshness

Showing 5161–5190 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-58667	medium	5.4/10	WordPress ListingPro Reviews plugin < 2.9.11 - Broken Access Control vulnerability	Sep 22, 2025 1y ago
CVE-2025-58666	medium	4.3/10	WordPress Website Chat Button: Kommo integration Plugin <= 1.3.1 - Broken Access Control Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58668	medium	4.3/10	WordPress WPLMS theme <= 4.970 - Broken Access Control vulnerability	Sep 22, 2025 1y ago
CVE-2025-58669	medium	5.9/10	WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability	Sep 22, 2025 1y ago
CVE-2025-58671	high	7.1/10	WordPress Auction Feed plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability	Sep 22, 2025 1y ago
CVE-2025-58670	high	7.1/10	WordPress WP Content Protection Plugin <= 1.3 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58672	medium	5.4/10	WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58675	medium	4.3/10	WordPress Interact: Embed A Quiz On Your Site Plugin <= 3.1 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58673	medium	5.4/10	WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58676	high	7.1/10	WordPress HORIZONTAL SLIDER Plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58677	high	7.1/10	WordPress ShrinkTheWeb (STW) Website Previews Plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58679	medium	5.3/10	WordPress AppMySite plugin <= 3.15.0 - Broken Access Control vulnerability	Sep 22, 2025 1y ago
CVE-2025-58678	medium	6.5/10	WordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58680	medium	6.5/10	WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability	Sep 22, 2025 1y ago
CVE-2025-58682	medium	6.5/10	WordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability	Sep 22, 2025 1y ago
CVE-2025-58681	medium	5.3/10	WordPress Easy Quotes Plugin <= 1.2.4 - Broken Access Control Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58683	medium	6.5/10	WordPress Last Updated Shortcode Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58684	medium	6.5/10	WordPress Logo Showcase plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability	Sep 22, 2025 1y ago
CVE-2025-58686	high	8.5/10	WordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerability	Sep 22, 2025 1y ago
CVE-2025-58685	medium	5.3/10	WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability	Sep 22, 2025 1y ago
CVE-2025-58687	high	7.1/10	WordPress Current Age Plugin Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58688	high	7.1/10	WordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58689	medium	6.5/10	WordPress Tapfiliate Plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58691	medium	6.5/10	WordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58690	high	7.1/10	WordPress Doliconnect Plugin <= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58702	medium	6.5/10	WordPress MarketKing Plugin <= 2.0.92 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58703	medium	6.5/10	WordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-58704	medium	6.5/10	WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 1y ago
CVE-2025-10489	medium	4.3/10	SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation	Sep 20, 2025 1y ago
CVE-2025-10690	critical	9.8/10	Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation	Sep 19, 2025 1y ago