Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

340,710

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,926

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 10081–10110 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-55999	medium	5.3/10	WordPress XML Multilanguage Sitemap Generator plugin <= 2.0.6 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-54348	medium	6.5/10	WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54285	critical	9.1/10	WordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54284	high	7.6/10	WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-54283	high	7.6/10	WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-54280	critical	9.3/10	WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-54279	high	7.5/10	WordPress WP-NERD Toolkit plugin <= 1.1 - Sensitive Data Exposure vulnerability	Dec 16, 2024 1y ago
CVE-2024-54257	high	7.1/10	WordPress tydskrif theme <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54249	high	7.1/10	WordPress Advanced Options Editor plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-43234	critical	9.8/10	WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability	Dec 16, 2024 1y ago
CVE-2024-54229	critical	9.8/10	WordPress SV100 Companion plugin <= 2.0.02 - Privilege Escalation vulnerability	Dec 16, 2024 1y ago
CVE-2024-37251	medium	4.3/10	WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability	Dec 16, 2024 1y ago
CVE-2024-56015	high	7.1/10	WordPress Tidy Up Plugin <= 1.3 - CSRF to Reflected Cross-Site Scripting vulnerability	Dec 16, 2024 1y ago
CVE-2024-54358	high	7.1/10	WordPress 3D Avatar User Profile plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54354	medium	6.5/10	WordPress Termin-Kalender plugin <= 0.99.47 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-54361	critical	9.3/10	WordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-54359	high	8.2/10	WordPress Banner System plugin <= 1.0.0 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-54364	high	7.1/10	WordPress Feedpress Generator plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54363	critical	9.8/10	WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability	Dec 16, 2024 1y ago
CVE-2024-54365	high	8.8/10	WordPress KH Easy User Settings plugin <= 1.0.0 - Privilege Escalation vulnerability	Dec 16, 2024 1y ago
CVE-2024-54368	critical	9.6/10	WordPress GitSync plugin <= 1.1.0 - CSRF to Remote Code Execution vulnerability	Dec 16, 2024 1y ago
CVE-2024-54367	critical	9.8/10	WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-54370	critical	9.9/10	WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.0 - Arbitrary File Upload vulnerability	Dec 16, 2024 1y ago
CVE-2024-54369	critical	9.1/10	WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability	Dec 16, 2024 1y ago
CVE-2024-54374	high	7.5/10	WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerability	Dec 16, 2024 1y ago
CVE-2024-54378	high	8.8/10	WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability	Dec 16, 2024 1y ago
CVE-2024-54375	high	7.5/10	WordPress Woolook plugin <= 1.7.0 - Local File Inclusion vulnerability	Dec 16, 2024 1y ago
CVE-2024-54380	high	7.5/10	WordPress WP Cookies Enabler plugin <= 1.0.1 - Local File Inclusion vulnerability	Dec 16, 2024 1y ago
CVE-2024-54379	high	8.8/10	WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability	Dec 16, 2024 1y ago
CVE-2024-54385	high	7.2/10	WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability	Dec 16, 2024 1y ago