Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

339,457

All time

Critical · Active

10,827

CVSS ≥ 9.0

New · 14 days

2,775

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 7921–7950 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-22672	medium	4.9/10	WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.2 - Server Side Request Forgery (SSRF) vulnerability	Mar 27, 2025 1y ago
CVE-2025-22770	medium	5.4/10	WordPress Envo Multipurpose theme <= 1.1.6 - Broken Access Control vulnerability	Mar 27, 2025 1y ago
CVE-2025-25086	high	7.1/10	WordPress Secret Meta plugin <= 1.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-22816	medium	6.5/10	WordPress Power Mag theme <= 1.1.5 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-25100	high	7.1/10	WordPress Cazamba plugin <= 1.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-26731	medium	6.5/10	WordPress ARPrice plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-26732	medium	6.5/10	WordPress StoreBiz plugin <= 1.0.32 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-26734	medium	6.5/10	WordPress Hester plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-26736	medium	6.5/10	WordPress MorningTime Lite theme <= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-26737	medium	6.5/10	WordPress City Store theme <= 1.4.5 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-26738	medium	6.5/10	WordPress Quick Interest Slider plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30925	medium	6.5/10	WordPress The Pack Elementor addons plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30923	medium	4.3/10	WordPress Gift Message for WooCommerce plugin <= 1.7.8 - Cross Site Request Forgery (CSRF) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30922	medium	6.5/10	WordPress Simplebooklet PDF Viewer and Embedder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30921	high	7.6/10	WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerability	Mar 27, 2025 1y ago
CVE-2025-30920	medium	6.5/10	WordPress WP Posts Carousel plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30919	high	7.1/10	WordPress Store Locator Widget plugin <= 2025r2 - CSRF to Stored XSS vulnerability	Mar 27, 2025 1y ago
CVE-2025-30918	medium	6.5/10	WordPress Structured Content plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30914	medium	4.4/10	WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30912	medium	5.4/10	WordPress Float menu plugin <= 6.1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Mar 27, 2025 1y ago
CVE-2025-30909	medium	4.3/10	WordPress Conversios.io plugin <= 7.2.3 - Broken Access Control vulnerability	Mar 27, 2025 1y ago
CVE-2025-30907	medium	6.5/10	WordPress SecuPress Free plugin <= 2.2.5.3 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30904	medium	5.9/10	WordPress Chartify plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30903	medium	6.5/10	WordPress SyntaxHighlighter Evolved plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30900	medium	6.5/10	WordPress Zoho Billing – Embed Payment Form plugin <= 4.0 - Stored Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30899	medium	5.9/10	WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30898	medium	6.5/10	WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2025 1y ago
CVE-2025-30897	medium	4.3/10	WordPress Analytify plugin <= 5.5.1 - Settings Change vulnerability	Mar 27, 2025 1y ago
CVE-2025-30896	medium	5.4/10	WordPress WP ERP plugin <= 1.13.4 - Broken Access Control vulnerability	Mar 27, 2025 1y ago
CVE-2025-30895	high	7.5/10	WordPress WpEvently Plugin <= 4.2.9 - PHP Object Injection vulnerability	Mar 27, 2025 1y ago