Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

340,489

All time

Critical · Active

11,003

CVSS ≥ 9.0

New · 14 days

2,932

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 9541–9570 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-22344	high	7.1/10	WordPress Media Category Library plugin <= 2.7 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22506	high	7.1/10	WordPress Smart Agenda Plugin <= 4.7 - CSRF to Stored XSS vulnerability	Jan 13, 2025 1y ago
CVE-2025-22499	high	7.1/10	WordPress F4 Post Tree Plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22567	high	7.1/10	WordPress TRUSTist REVIEWer Plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22514	high	7.1/10	WordPress Axact Author List Widget Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22568	high	7.1/10	WordPress Post And Page Reactions Plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22570	high	7.1/10	WordPress Inline Tweets plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22569	high	7.1/10	WordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22583	high	7.1/10	WordPress Scan External Links Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22576	high	7.1/10	WordPress Site PIN Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22588	high	7.1/10	WordPress Scanventory Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22586	high	7.1/10	WordPress WPEX Replace DB Urls Plugin <= 0.4.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2025-22777	critical	9.8/10	WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability	Jan 13, 2025 1y ago
CVE-2024-12412	medium	6.1/10	Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently \| WordPress plugin <= 2.2.1 - Reflected Cross-Site Scripting	Jan 11, 2025 1y ago
CVE-2024-12473	medium	6.5/10	AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection	Jan 10, 2025 1y ago
CVE-2024-12606	medium	4.3/10	AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Jan 10, 2025 1y ago
CVE-2025-22295	high	7.1/10	WordPress Tripetto plugin <= 8.0.6 - Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22313	high	7.1/10	WordPress Widgetize Pages Light plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22307	high	7.1/10	WordPress Product Table for WooCommerce plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22331	high	7.1/10	WordPress Cf7Save Extension plugin <= 1 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22330	high	7.1/10	WordPress MG Parallax Slider plugin <= 1.0. - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22345	high	7.1/10	WordPress TS Comfort DB plugin <= 2.0.7 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22504	critical	10.0/10	WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability	Jan 9, 2025 1y ago
CVE-2025-22361	high	7.1/10	WordPress Opentracker Analytics Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22508	high	8.1/10	WordPress FAT Event Lite plugin <= 1.1 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability	Jan 9, 2025 1y ago
CVE-2025-22505	high	8.5/10	WordPress NC Wishlist for Woocommerce Plugin <= 1.0.1 - SQL Injection vulnerability	Jan 9, 2025 1y ago
CVE-2025-22521	high	7.1/10	WordPress wp Hosting Performance Check Plugin <= 2.18.8 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22510	high	7.2/10	WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability	Jan 9, 2025 1y ago
CVE-2025-22535	high	8.5/10	WordPress WPListCal Plugin <= 1.3.5 - SQL Injection vulnerability	Jan 9, 2025 1y ago
CVE-2025-22527	high	7.6/10	WordPress Mailing Group Listserv Plugin <= 2.0.9 - SQL Injection vulnerability	Jan 9, 2025 1y ago