Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,911

All time

Critical · Active

12,254

CVSS ≥ 9.0

New · 14 days

2,544

Newly disclosed

Feed last synced

58 mins ago

Data freshness

Showing 8731–8760 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-30541	medium	4.3/10	WordPress Info Boxes Shortcode And Widgets plugin <= 1.15 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30540	medium	5.9/10	WordPress AvaiBook plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30539	medium	5.9/10	WordPress BMo Expo plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30538	medium	4.3/10	WordPress Simple Optimizer plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30537	medium	5.9/10	WordPress Upload Quota per User plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability	Mar 24, 2025 1y ago
CVE-2025-30536	medium	5.9/10	WordPress Beautiful Link Preview plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30535	medium	4.3/10	WordPress External image replace plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Mar 24, 2025 1y ago
CVE-2025-30534	medium	4.3/10	WordPress Image Captcha plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Mar 24, 2025 1y ago
CVE-2025-30533	medium	5.9/10	WordPress Message ticker plugin <= 9.3 - Cross Site Scripting (XSS) Vulnerability	Mar 24, 2025 1y ago
CVE-2025-30532	medium	5.9/10	WordPress Weather Layer plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30531	medium	4.3/10	WordPress WP Ride Booking plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability	Mar 24, 2025 1y ago
CVE-2025-30530	medium	5.9/10	WordPress AI Preloader plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30529	medium	4.3/10	WordPress Auto Load Next Post plugin <= 1.5.14 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30528	critical	9.3/10	WordPress Awesome Logos plugin <= 1.2 - CSRF to SQL Injection vulnerability	Mar 24, 2025 1y ago
CVE-2025-30527	medium	5.9/10	WordPress My Bootstrap Menu plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30526	medium	4.3/10	WordPress Typekit plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2025-30525	high	7.6/10	WordPress WP Profitshare plugin <= 1.4.9 - SQL Injection vulnerability	Mar 24, 2025 1y ago
CVE-2025-30523	high	7.6/10	WordPress Super Simple Subscriptions plugin <= 1.1.0 - SQL Injection vulnerability	Mar 24, 2025 1y ago
CVE-2025-30522	high	7.1/10	WordPress Contact Form 7 Material Design plugin <= 1.0.0 - CSRF to Stored XSS vulnerability	Mar 24, 2025 1y ago
CVE-2025-30521	medium	4.3/10	WordPress GP Back To Top plugin <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability	Mar 24, 2025 1y ago
CVE-2024-12920	high	8.8/10	FoodBakery \| Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple Functions	Mar 19, 2025 1y ago
CVE-2024-13933	high	8.8/10	FoodBakery \| Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions	Mar 19, 2025 1y ago
CVE-2024-13790	critical	9.8/10	MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion	Mar 19, 2025 1y ago
CVE-2025-26978	high	8.5/10	WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerability	Mar 15, 2025 1y ago
CVE-2025-26976	high	8.5/10	WordPress PrivateContent plugin <= 8.11.4 - SQL Injection vulnerability	Mar 15, 2025 1y ago
CVE-2025-26972	high	7.1/10	WordPress PrivateContent plugin <= 8.11.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 15, 2025 1y ago
CVE-2025-26969	high	8.3/10	WordPress PrivateContent plugin <= 8.11.5 - Subscriber+ Site Wide Broken Access Control vulnerability	Mar 15, 2025 1y ago
CVE-2025-26961	high	8.6/10	WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability	Mar 15, 2025 1y ago
CVE-2025-26940	medium	6.3/10	WordPress Pie Register Premium plugin <= 3.8.3.2 - Path Traversal to Non-Arbitrary File Deletion vulnerability	Mar 15, 2025 1y ago
CVE-2025-26924	medium	6.5/10	WordPress Ohio Theme Extra plugin <= 3.4.7 - Shortcode Injection vulnerability	Mar 15, 2025 1y ago