Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

355,422

All time

Critical · Active

12,666

CVSS ≥ 9.0

New · 14 days

1,951

Newly disclosed

Feed last synced

37 mins ago

Data freshness

Showing 841–870 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-57687	high	8.5/10	WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57686	high	7.1/10	WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57685	medium	4.3/10	WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57684	medium	6.5/10	WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57683	critical	9.3/10	WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57682	high	7.1/10	WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57681	medium	6.4/10	WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57680	medium	6.5/10	WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57679	critical	9.3/10	WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57677	critical	9.8/10	WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57675	high	7.1/10	WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57674	high	7.1/10	WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57673	high	7.1/10	WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57672	high	7.1/10	WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57671	high	7.1/10	WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57670	high	7.1/10	WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57669	medium	6.5/10	WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57625	critical	9.6/10	WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57624	critical	10.0/10	WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57623	critical	9.0/10	WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57621	critical	9.8/10	WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57426	high	7.1/10	WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57366	high	7.1/10	WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57362	high	7.1/10	WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57361	high	7.1/10	WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57360	high	7.1/10	WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57359	high	7.1/10	WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57358	high	7.1/10	WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57357	high	7.1/10	WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago
CVE-2026-57356	high	7.1/10	WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 3mo ago