Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,656

All time

Critical · Active

12,241

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

36 mins ago

Data freshness

Showing 6391–6420 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-48267	high	8.6/10	WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48279	high	7.1/10	WordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability	Jun 9, 2025 1y ago
CVE-2025-49265	high	7.5/10	WordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48281	critical	9.3/10	WordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49275	high	8.1/10	WordPress Blogbyte theme <= 1.1.1 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49276	high	8.1/10	WordPress Blogmine theme <= 1.1.7 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49278	high	8.1/10	WordPress Blogty theme <= 1.0.11 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49277	high	8.1/10	WordPress Blogprise theme <= 1.0.9 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49279	high	8.1/10	WordPress Blogvy theme <= 1.0.7 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49280	high	8.1/10	WordPress Magty theme <= 1.0.6 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49282	high	8.1/10	WordPress Magze theme <= 1.0.9 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49281	high	8.1/10	WordPress Magways theme <= 1.2.1 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49295	high	8.1/10	WordPress MediClinic theme <= 2.1 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49296	high	8.1/10	WordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49297	high	8.1/10	WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-47601	high	8.8/10	WordPress MaxiBlocks plugin <= 2.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability	Jun 7, 2025 1y ago
CVE-2025-49419	medium	5.5/10	WordPress Foxit eSign for WordPress plugin <= 2.0.3 - Other Vulnerability Type Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49425	high	7.1/10	WordPress Konami Easter Egg plugin <= v0.4 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49421	high	7.6/10	WordPress WP Text Expander plugin <= 1.0.1 - SQL Injection Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49429	medium	6.5/10	WordPress Video Embeds plugin <= 0.1.1 - Cross Site Scripting (XSS) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49427	medium	6.5/10	WordPress Abbie Expander plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49439	medium	4.3/10	WordPress Atelier Create CV plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Jun 6, 2025 1y ago
CVE-2025-49435	medium	4.3/10	WordPress Wp Easy Allopass plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49441	medium	5.3/10	WordPress Interactive Regional Map of Florida plugin <= 1.0 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49440	medium	4.3/10	WordPress WP Security Master plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49443	medium	6.5/10	WordPress Bacon Ipsum plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49442	medium	6.5/10	WordPress Simple Nested Menu plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49446	medium	4.3/10	WordPress Admin Notes plugin <=1.1 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49445	medium	4.3/10	WordPress Interactive UK Regional Map plugin <= 2.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Jun 6, 2025 1y ago
CVE-2025-49450	medium	6.5/10	WordPress SEPA Girocode plugin <= 0.5.1 - Cross Site Scripting (XSS) Vulnerability	Jun 6, 2025 1y ago