Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

339,480

All time

Critical · Active

10,829

CVSS ≥ 9.0

New · 14 days

2,730

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 8101–8130 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-26537	medium	6.5/10	WordPress GDPR Tools plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26536	high	7.1/10	WordPress Another Events Calendar Plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-25134	high	7.1/10	WordPress Theme Demo Bar Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-24690	high	8.1/10	WordPress Formality Plugin <= 1.5.7 - Local File Inclusion vulnerability	Mar 26, 2025 1y ago
CVE-2025-23964	high	7.1/10	WordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23952	high	8.1/10	WordPress Custom Field List Widget Plugin <= 1.5.1 - Local File Inclusion vulnerability	Mar 26, 2025 1y ago
CVE-2025-23937	high	8.1/10	WordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerability	Mar 26, 2025 1y ago
CVE-2025-23735	high	7.1/10	WordPress Infugrator plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23728	high	7.1/10	WordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23714	high	7.1/10	WordPress AppReview plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23704	high	7.1/10	WordPress Your Lightbox plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23680	high	7.1/10	WordPress Narnoo Operator plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23666	high	7.1/10	WordPress Management-screen-droptiles plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23638	high	7.1/10	WordPress Frontend Post Submission plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23633	high	7.1/10	WordPress WP Database Audit plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23632	high	7.1/10	WordPress CG Button plugin <= 1.0.5.6 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23612	high	7.1/10	WordPress Pixobe Cartography plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23546	high	7.1/10	WordPress RDP inGroups+ plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23543	high	7.1/10	WordPress FOMO Pay Chinese Payment Solution plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23542	high	7.1/10	WordPress RDP Linkedin Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23466	high	7.1/10	WordPress Site Editor Google Map plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23460	high	7.1/10	WordPress RWS Enquiry And Lead Follow-up plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23459	high	7.1/10	WordPress NS Simple Intro Loader plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-22283	high	7.1/10	WordPress GetSocial Plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-1312	medium	6.4/10	Ultimate Blocks – WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 26, 2025 1y ago
CVE-2024-13411	medium	6.4/10	Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function	Mar 26, 2025 1y ago
CVE-2024-13889	high	7.2/10	WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection	Mar 26, 2025 1y ago
CVE-2025-1310	medium	6.5/10	Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read	Mar 26, 2025 1y ago
CVE-2025-2257	high	7.2/10	Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection	Mar 26, 2025 1y ago
CVE-2025-30567	high	7.5/10	WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability	Mar 25, 2025 1y ago