Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,530

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,089

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 5371–5400 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-58601	medium	4.3/10	WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58600	medium	5.3/10	WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58599	medium	4.3/10	WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58598	medium	6.6/10	WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58597	medium	4.3/10	WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58596	medium	5.9/10	WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58594	medium	4.3/10	WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58593	medium	6.5/10	WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-3701	medium	4.3/10	WordPress Malcure Malware Scanner plugin <= 16.8 - Broken Access Control vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58210	medium	5.3/10	WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability	Sep 3, 2025 12mo ago
CVE-2024-32444	critical	9.8/10	WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability	Sep 3, 2025 12mo ago
CVE-2025-31100	critical	9.9/10	WordPress School Management Plugin <= 1.93.1 (02-07-2025) - Arbitrary File Upload Vulnerability	Aug 31, 2025 1y ago
CVE-2025-47696	high	8.1/10	WordPress Blog Designer PRO plugin <= 3.4.7 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability	Aug 31, 2025 1y ago
CVE-2024-32832	critical	9.8/10	WordPress Login with Phone Number plugin <= 1.6.93 - Broken Access Control vulnerability	Aug 31, 2025 1y ago
CVE-2024-32589	high	7.1/10	WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Broken Access Control to XSS vulnerability	Aug 31, 2025 1y ago
CVE-2025-4956	medium	4.3/10	WordPress Pro Bulk Watermark Plugin for WordPress Theme <= 2.0 - Path Traversal Vulnerability	Aug 30, 2025 1y ago
CVE-2025-54742	high	8.8/10	WordPress WpEvently Plugin <= 4.4.8 - PHP Object Injection Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54738	critical	9.8/10	WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54734	medium	5.8/10	WordPress B Slider Plugin <= 1.1.30 - Broken Access Control Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54733	medium	6.5/10	WordPress All Bootstrap Blocks Plugin <= 1.3.28 - Broken Access Control Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54731	high	8.1/10	WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54725	critical	9.8/10	WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54724	high	7.1/10	WordPress Golo Theme <= 1.7.1 - Cross Site Scripting (XSS) Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54720	critical	9.3/10	WordPress Nest Addons Plugin <= 1.6.3 - SQL Injection Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54716	high	8.1/10	WordPress Ireca Theme <= 1.8.5 - Local File Inclusion Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54714	high	7.1/10	WordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54710	high	7.1/10	WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability	Aug 28, 2025 1y ago
CVE-2025-54029	high	7.7/10	WordPress WooCommerce csv import export Plugin <= 2.0.6 - Arbitrary File Deletion Vulnerability	Aug 28, 2025 1y ago
CVE-2025-53588	high	7.7/10	WordPress UPC/EAN/GTIN Code Generator Plugin <= 2.0.2 - Arbitrary File Deletion Vulnerability	Aug 28, 2025 1y ago
CVE-2025-53584	high	8.1/10	WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection Vulnerability	Aug 28, 2025 1y ago