Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

340,708

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,926

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 10021–10050 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-56215	medium	4.3/10	WordPress Member Directory and Contact Form plugin <= 1.7.0 - Broken Access Control vulnerability	Dec 31, 2024 1y ago
CVE-2024-56235	medium	6.5/10	WordPress Coupon plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56256	medium	5.9/10	WordPress Embed PDF Viewer plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56265	high	7.1/10	WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56218	medium	4.3/10	WordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56222	medium	5.4/10	WordPress CodeBard Help Desk plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56229	medium	4.3/10	WordPress SearchIQ plugin <= 4.6 - Cross-Site Requst Forgery (CSRF) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56232	high	7.1/10	WordPress WP Nice Loader plugin <= 0.1.0.4 - CSRF to Stored XSS vulnerability	Dec 31, 2024 1y ago
CVE-2024-56220	critical	9.8/10	WordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerability	Dec 31, 2024 1y ago
CVE-2024-56212	high	8.5/10	WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability	Dec 31, 2024 1y ago
CVE-2024-56211	high	8.8/10	WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability	Dec 31, 2024 1y ago
CVE-2024-56213	medium	6.5/10	WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability	Dec 31, 2024 1y ago
CVE-2024-56214	high	8.3/10	WordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability	Dec 31, 2024 1y ago
CVE-2024-56216	medium	6.5/10	WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability	Dec 31, 2024 1y ago
CVE-2024-56230	high	7.5/10	WordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerability	Dec 31, 2024 1y ago
CVE-2024-12636	medium	4.3/10	Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.2.7 - Cross-Site Request Forgery	Dec 25, 2024 1y ago
CVE-2024-12272	high	8.8/10	WP Travel Engine – Elementor Widgets \| Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion	Dec 25, 2024 1y ago
CVE-2024-12032	medium	6.5/10	Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin \| WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection	Dec 25, 2024 1y ago
CVE-2024-12268	medium	6.4/10	Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 24, 2024 1y ago
CVE-2024-12622	medium	6.4/10	WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 24, 2024 1y ago
CVE-2024-12100	medium	6.1/10	Bitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scripting	Dec 24, 2024 1y ago
CVE-2024-12771	high	8.8/10	eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset	Dec 21, 2024 1y ago
CVE-2024-12506	medium	6.4/10	NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 20, 2024 1y ago
CVE-2024-11784	medium	6.4/10	Sell Tickets Online – TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 20, 2024 1y ago
CVE-2024-11297	medium	5.3/10	Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure	Dec 20, 2024 1y ago
CVE-2024-37962	medium	6.5/10	WordPress Fusion Page Builder plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability	Dec 19, 2024 1y ago
CVE-2024-56047	high	8.5/10	WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-56053	high	7.6/10	WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-56048	high	8.8/10	WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability	Dec 18, 2024 1y ago
CVE-2024-56050	critical	9.9/10	WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability	Dec 18, 2024 1y ago