Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

352,250

All time

Critical · Active

12,441

CVSS ≥ 9.0

New · 14 days

2,165

Newly disclosed

Feed last synced

39 mins ago

Data freshness

Showing 841–870 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-52712	high	7.6/10	WordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability	Jun 16, 2026 3mo ago
CVE-2026-52711	high	7.5/10	WordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerability	Jun 16, 2026 3mo ago
CVE-2026-39581	high	8.5/10	WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability	Jun 16, 2026 3mo ago
CVE-2026-39574	critical	9.3/10	WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability	Jun 16, 2026 3mo ago
CVE-2026-39490	high	7.5/10	WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability	Jun 16, 2026 3mo ago
CVE-2026-39437	high	7.1/10	WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 16, 2026 3mo ago
CVE-2025-68045	high	7.5/10	WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability	Jun 16, 2026 3mo ago
CVE-2026-52703	critical	9.6/10	WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52702	high	7.1/10	WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52700	high	8.5/10	WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52699	high	7.5/10	WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52697	high	8.5/10	WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52695	high	7.5/10	WordPress ABC Crypto Checkout plugin <= 1.8.2 - Sensitive Data Exposure vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52694	high	7.5/10	WordPress Signature Add-On for WooCommerce plugin <= 2.0 - Sensitive Data Exposure vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52693	critical	9.3/10	WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-52692	high	7.5/10	WordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49781	critical	9.8/10	WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49780	high	8.8/10	WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49776	critical	9.3/10	WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49775	medium	6.5/10	WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49773	medium	6.5/10	WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49770	critical	9.8/10	WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49769	critical	9.8/10	WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49768	critical	9.8/10	WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49766	critical	9.9/10	WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49765	critical	9.8/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49764	critical	9.8/10	WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49763	critical	9.8/10	WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49112	high	7.5/10	WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49110	high	7.5/10	WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability	Jun 15, 2026 3mo ago