Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

339,483

All time

Critical · Active

10,830

CVSS ≥ 9.0

New · 14 days

2,712

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 8191–8220 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-30550	high	7.1/10	WordPress CallPhone'r plugin <= 1.1.1 - CSRF to Stored XSS vulnerability	Mar 24, 2025 1y ago
CVE-2025-30549	medium	4.3/10	WordPress Yummly Rich Recipes plugin <= 4.2 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30546	medium	4.3/10	WordPress Cackle plugin <= 4.33 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30545	medium	5.9/10	WordPress issuuPress plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30543	medium	4.3/10	WordPress Menu Duplicator plugin <= 1.0 - Broken Access Control vulnerability	Mar 24, 2025 1y ago
CVE-2025-30542	medium	4.3/10	WordPress WP SoundCloud Ultimate plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30541	medium	4.3/10	WordPress Info Boxes Shortcode And Widgets plugin <= 1.15 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30540	medium	5.9/10	WordPress AvaiBook plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30539	medium	5.9/10	WordPress BMo Expo plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30538	medium	4.3/10	WordPress Simple Optimizer plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30537	medium	5.9/10	WordPress Upload Quota per User plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability	Mar 24, 2025 1y ago
CVE-2025-30536	medium	5.9/10	WordPress Beautiful Link Preview plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30535	medium	4.3/10	WordPress External image replace plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Mar 24, 2025 1y ago
CVE-2025-30534	medium	4.3/10	WordPress Image Captcha plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Mar 24, 2025 1y ago
CVE-2025-30533	medium	5.9/10	WordPress Message ticker plugin <= 9.3 - Cross Site Scripting (XSS) Vulnerability	Mar 24, 2025 1y ago
CVE-2025-30532	medium	5.9/10	WordPress Weather Layer plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30531	medium	4.3/10	WordPress WP Ride Booking plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability	Mar 24, 2025 1y ago
CVE-2025-30530	medium	5.9/10	WordPress AI Preloader plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30529	medium	4.3/10	WordPress Auto Load Next Post plugin <= 1.5.14 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30528	critical	9.3/10	WordPress Awesome Logos plugin <= 1.2 - CSRF to SQL Injection vulnerability	Mar 24, 2025 1y ago
CVE-2025-30527	medium	5.9/10	WordPress My Bootstrap Menu plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30526	medium	4.3/10	WordPress Typekit plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30525	high	7.6/10	WordPress WP Profitshare plugin <= 1.4.9 - SQL Injection vulnerability	Mar 24, 2025 1y ago
CVE-2025-30523	high	7.6/10	WordPress Super Simple Subscriptions plugin <= 1.1.0 - SQL Injection vulnerability	Mar 24, 2025 1y ago
CVE-2025-30522	high	7.1/10	WordPress Contact Form 7 Material Design plugin <= 1.0.0 - CSRF to Stored XSS vulnerability	Mar 24, 2025 1y ago
CVE-2025-30521	medium	4.3/10	WordPress GP Back To Top plugin <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2024-12920	high	8.8/10	FoodBakery \| Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple Functions	Mar 19, 2025 1y ago
CVE-2024-13933	high	8.8/10	FoodBakery \| Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions	Mar 19, 2025 1y ago
CVE-2024-13790	critical	9.8/10	MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion	Mar 19, 2025 1y ago
CVE-2025-26978	high	8.5/10	WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerability	Mar 15, 2025 1y ago