Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

340,746

All time

Critical · Active

11,013

CVSS ≥ 9.0

New · 14 days

2,907

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 10231–10260 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-54330	high	7.2/10	WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54329	high	7.1/10	WordPress CleverNode Related Content plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54328	high	7.1/10	WordPress Invoice Payment for WooCommerce plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54327	high	7.1/10	WordPress UNIVERSAM plugin < 8.59 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54326	medium	6.5/10	WordPress GEO my WP plugin <= 4.5.0.4 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2024-54325	high	7.1/10	WordPress CarDealerPress plugin <= 6.6.2410.02 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54324	high	7.1/10	WordPress SMSify plugin <= 6.0.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54323	medium	5.4/10	WordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2024-54322	high	7.1/10	WordPress Media Downloader plugin <= 0.4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54321	medium	4.3/10	WordPress Hive Support plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54320	high	7.1/10	WordPress ICDSoft Reseller Store plugin<= 2.4.5 -Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54319	high	7.1/10	WordPress Kundgenerator plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54318	medium	6.5/10	WordPress NiceJob plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54317	medium	6.5/10	WordPress Web Stories plugin <= 1.37.0 - Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54316	medium	6.5/10	WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54315	medium	6.5/10	WordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54314	medium	6.5/10	WordPress Primary Addon for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54313	medium	6.5/10	WordPress FULL – Cliente plugin <= 3.1.25 - Local File Inclusion vulnerability	Dec 13, 2024 1y ago
CVE-2024-54312	high	7.1/10	WordPress افزونه پیامک ووکامرس Persian WooCommerce SMS plugin <= 7.0.5 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54311	medium	5.4/10	WordPress Mark New Posts plugin <= 7.5.1 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2024-54310	medium	5.3/10	WordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2024-54309	medium	6.5/10	WordPress PostBox plugin <= 1.0.4 - Sensitive Data Exposure vulnerability	Dec 13, 2024 1y ago
CVE-2024-54308	medium	5.9/10	WordPress Cryptocurrency Price Widget plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54307	medium	4.3/10	WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54306	medium	4.3/10	WordPress AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54305	high	7.1/10	WordPress J&T Express Malaysia plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54304	high	8.5/10	WordPress Hive Support plugin <= 1.1.2 - SQL Injection vulnerability	Dec 13, 2024 1y ago
CVE-2024-54303	high	7.1/10	WordPress Simple Payment plugin <= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54302	high	7.1/10	WordPress VForm plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54301	high	7.1/10	WordPress FormFacade plugin <= 1.3.6 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago