Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,602

All time

Critical · Active

12,236

CVSS ≥ 9.0

New · 14 days

3,055

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 6121–6150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-52727	high	7.1/10	WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52778	high	7.1/10	WordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52774	high	7.1/10	WordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-52808	high	8.1/10	WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52799	high	7.1/10	WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52809	high	8.1/10	WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52811	high	8.1/10	WordPress Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52810	high	8.1/10	WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52812	high	8.1/10	WordPress Domnoo theme <= 1.49 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52815	high	8.1/10	WordPress CityGov theme <= 1.9 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52814	high	8.1/10	WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52817	high	8.2/10	WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerability	Jun 27, 2025 1y ago
CVE-2025-52816	high	8.1/10	WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52818	high	8.2/10	WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerability	Jun 27, 2025 1y ago
CVE-2025-52826	high	8.8/10	WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52824	high	8.8/10	WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerability	Jun 27, 2025 1y ago
CVE-2025-52827	high	8.8/10	WordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52834	critical	9.3/10	WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability	Jun 27, 2025 1y ago
CVE-2025-52829	critical	9.3/10	WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2023-25998	high	8.1/10	WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-23973	high	7.1/10	WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-23967	critical	9.3/10	WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-49416	high	8.1/10	WordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-24760	high	8.1/10	WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-49423	high	7.1/10	WordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-49448	high	8.6/10	WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Deletion Vulnerability	Jun 27, 2025 1y ago
CVE-2024-12827	critical	9.8/10	DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset	Jun 27, 2025 1y ago
CVE-2025-4587	medium	6.4/10	A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2025 1y ago
CVE-2025-5143	medium	6.4/10	TableOn – WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode	Jun 21, 2025 1y ago
CVE-2025-49873	high	7.1/10	WordPress Elessi theme <= 6.3.9 - Cross Site Scripting (XSS) Vulnerability	Jun 20, 2025 1y ago