Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

340,899

All time

Critical · Active

11,029

CVSS ≥ 9.0

New · 14 days

3,052

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 10291–10320 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-56001	medium	6.5/10	WordPress Ksher plugin <= 1.1.1 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-55994	medium	4.3/10	WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-56007	medium	4.3/10	WordPress Leader plugin <= 2.6.1 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-56009	medium	5.3/10	WordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-54360	medium	6.5/10	WordPress Gutensee plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54442	medium	5.9/10	WordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54441	medium	6.5/10	WordPress Utech World Time Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54443	medium	6.5/10	WordPress Advanced Data Table For Elementor plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-56011	medium	6.5/10	WordPress Responsive Google Maps \| by imbaa plugin <= 1.2.5 - Stored Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54331	high	7.1/10	WordPress I Plant A Tree plugin <= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerability	Dec 16, 2024 1y ago
CVE-2024-54355	medium	4.3/10	WordPress WP Mailster plugin <= 1.8.17.0 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54352	high	8.8/10	WordPress Sogrid plugin <= 1.5.2 - CSRF to Privilege Escalation vulnerability	Dec 16, 2024 1y ago
CVE-2024-54356	medium	5.4/10	WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54396	medium	4.3/10	WordPress Bet sport Free plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54372	critical	9.6/10	WordPress Insertify plugin <= 1.1.4 - CSRF to Remote Code Execution vulnerability	Dec 16, 2024 1y ago
CVE-2024-54419	medium	5.4/10	WordPress Ui Slider Filter By Price plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54418	medium	5.4/10	WordPress DTC Documents plugin <= 1.1.05 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2024 1y ago
CVE-2024-56005	medium	6.5/10	WordPress Posti Shipping Plugin <= 3.10.3 - CSRF to Settings Change vulnerability	Dec 16, 2024 1y ago
CVE-2024-54353	high	7.1/10	WordPress Hack-Info plugin <= 3.17 - CSRF to Stored Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54332	high	7.1/10	WordPress WP Currency Exchange Rates plugin <= 1.2.0 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54388	high	7.1/10	WordPress Multiple Admin Emails plugin <= 1.0 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54386	high	7.1/10	WordPress Push Monkey Pro plugin <= 3.9 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54389	high	7.1/10	WordPress addWeather plugin <= 2.5.1 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54392	high	7.1/10	WordPress WP微信机器人 plugin <= 5.3.5 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54391	high	7.1/10	WordPress WordPress Filter plugin <= 1.4.1 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54394	high	7.1/10	WordPress Mandrill WP plugin <= 1.0.5 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54393	high	7.1/10	WordPress WP Fiddle plugin <= 1.0 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54397	high	7.1/10	WordPress Go Animate plugin <= 1.0 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54399	high	7.1/10	WordPress CRUDLab Google Plus Button plugin <= 1.0.2 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54398	high	7.1/10	WordPress Flaming Forms plugin <= 1.0.1 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago