Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

353,115

All time

Critical · Active

12,509

CVSS ≥ 9.0

New · 14 days

1,014

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 8641–8670 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-28865	high	7.1/10	WordPress WP Colorful Tag Cloud plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-28858	high	7.1/10	WordPress Arrow Maps plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-28855	high	7.1/10	WordPress Teleport plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26584	high	7.1/10	WordPress TBTestimonials Plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26583	high	7.1/10	WordPress Video Share VOD plugin <= 2.7.9 - Reflected Cross-Site Scripting vulnerability	Mar 26, 2025 1y ago
CVE-2025-26581	high	7.1/10	WordPress Picture Gallery plugin <= 1.6.3 - CSRF to Stored XSS vulnerability	Mar 26, 2025 1y ago
CVE-2025-26579	high	7.1/10	WordPress MicroPayments Paid Membership plugin <= 3.2.4 - Reflected Cross-Site Scripting vulnerability	Mar 26, 2025 1y ago
CVE-2025-26576	high	7.1/10	WordPress WP Simple Slideshow Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26575	high	7.1/10	WordPress Display Post Meta plugin <= 1.5- Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26573	high	7.1/10	WordPress Rizzi Guestbook plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26566	high	7.1/10	WordPress In Stock Mailer for WooCommerce Plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26565	high	7.1/10	WordPress GNUPress Plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26564	high	7.1/10	WordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26560	high	7.1/10	WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26559	medium	6.5/10	WordPress Secure Invites plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26546	high	7.1/10	WordPress Cookies Pro plugin <= 1.0 - CSRF to Stored XSS vulnerability	Mar 26, 2025 1y ago
CVE-2025-26544	high	7.1/10	WordPressUTM tags + Landing page plugin <= 1.4 - CSRF to Stored XSS vulnerability	Mar 26, 2025 1y ago
CVE-2025-26542	high	7.1/10	WordPress Zalo Live Chat Plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26541	high	7.1/10	WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26537	medium	6.5/10	WordPress GDPR Tools plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-26536	high	7.1/10	WordPress Another Events Calendar Plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-25134	high	7.1/10	WordPress Theme Demo Bar Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-24690	high	8.1/10	WordPress Formality Plugin <= 1.5.7 - Local File Inclusion vulnerability	Mar 26, 2025 1y ago
CVE-2025-23964	high	7.1/10	WordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23952	high	8.1/10	WordPress Custom Field List Widget Plugin <= 1.5.1 - Local File Inclusion vulnerability	Mar 26, 2025 1y ago
CVE-2025-23937	high	8.1/10	WordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerability	Mar 26, 2025 1y ago
CVE-2025-23735	high	7.1/10	WordPress Infugrator plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23728	high	7.1/10	WordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23714	high	7.1/10	WordPress AppReview plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago
CVE-2025-23704	high	7.1/10	WordPress Your Lightbox plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 26, 2025 1y ago