Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

340,708

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,926

Newly disclosed

Feed last synced

58 mins ago

Data freshness

Showing 9991–10020 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-56044	critical	9.8/10	WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability	Dec 31, 2024 1y ago
CVE-2024-56043	critical	9.8/10	WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability	Dec 31, 2024 1y ago
CVE-2024-56040	critical	9.8/10	WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability	Dec 31, 2024 1y ago
CVE-2024-56042	critical	9.3/10	WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability	Dec 31, 2024 1y ago
CVE-2024-56041	high	8.5/10	WordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerability	Dec 31, 2024 1y ago
CVE-2024-56039	critical	9.3/10	WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability	Dec 31, 2024 1y ago
CVE-2024-56064	critical	10.0/10	WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability	Dec 31, 2024 1y ago
CVE-2024-56046	critical	10.0/10	WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability	Dec 31, 2024 1y ago
CVE-2024-56068	high	7.5/10	WordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerability	Dec 31, 2024 1y ago
CVE-2024-55991	medium	6.5/10	WordPress CRM Plugin – WP-CRM System plugin <= 3.2.9.1 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2024-56031	medium	6.5/10	WordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerability	Dec 31, 2024 1y ago
CVE-2024-56067	high	7.5/10	WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability	Dec 31, 2024 1y ago
CVE-2023-48775	medium	5.3/10	WordPress WP CleanFix plugin <= 5.6.2 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2023-50850	medium	4.3/10	WordPress Woo Subscriptions plugin < 5.8.0 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2024-56071	critical	9.8/10	WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability	Dec 31, 2024 1y ago
CVE-2024-56205	critical	9.8/10	WordPress AI Magic – SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation vulnerability	Dec 31, 2024 1y ago
CVE-2024-56209	high	7.1/10	WordPress Kleo theme < 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56210	high	7.1/10	WordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56221	medium	6.5/10	WordPress WPMozo Addons Lite for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56223	high	7.1/10	WordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56224	medium	6.5/10	WordPress Ledenbeheer plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56226	high	7.1/10	WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56228	high	7.1/10	WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56231	medium	6.5/10	WordPress SaasPricing plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56233	high	7.1/10	WordPress Kintpv Wooconnect plugin <= 8.129 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56234	medium	5.4/10	WordPress VW Automobile Lite theme <= 2.1 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2024-56227	medium	4.3/10	WordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2024-56225	medium	5.4/10	WordPress Premium Addons for Elementor plugin <= 4.10.56 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2024-56219	medium	4.3/10	WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2024-56217	medium	4.3/10	WordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerability	Dec 31, 2024 1y ago