Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

353,665

All time

Critical · Active

12,527

CVSS ≥ 9.0

New · 14 days

1,392

Newly disclosed

Feed last synced

7 hrs ago

Data freshness

Showing 10291–10320 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-56298	medium	5.9/10	WordPress Pretty Simple Popup Builder Plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2024-56300	high	7.5/10	WordPress Post/Page Copying Tool plugin <= 2.0.0 - Sensitive Data Exposure vulnerability	Jan 7, 2025 1y ago
CVE-2025-22261	medium	6.5/10	WordPress WP FullCalendar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22293	medium	6.5/10	WordPress Gutentor plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22298	medium	4.3/10	WordPress Hive Support plugin <= 1.1.6 - Broken Access Control vulnerability	Jan 7, 2025 1y ago
CVE-2025-22297	medium	4.3/10	WordPress AI WP Writer plugin <= 3.8.4.4 - Cross Site Request Forgery (CSRF) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22299	medium	4.3/10	WordPress AI for SEO plugin <= 1.2.9 - Broken Access Control vulnerability	Jan 7, 2025 1y ago
CVE-2025-22300	medium	5.4/10	WordPress PixelYourSite plugin <= 10.0.1.2 - Cross Site Request Forgery (CSRF) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22301	medium	5.4/10	WordPress MyBookTable Bookstore by Stormhill Media plugin <= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22302	medium	5.3/10	WordPress WP Wand plugin <= 1.2.5 - Broken Access Control vulnerability	Jan 7, 2025 1y ago
CVE-2025-22303	medium	5.3/10	WordPress WP Mailster plugin <= 1.8.17.0 - Sensitive Data Exposure vulnerability	Jan 7, 2025 1y ago
CVE-2025-22305	medium	6.5/10	WordPress Hero Banner Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability	Jan 7, 2025 1y ago
CVE-2025-22304	medium	4.3/10	WordPress WP Visitor Statistics plugin <= 7.5 - Broken Access Control vulnerability	Jan 7, 2025 1y ago
CVE-2025-22308	medium	6.5/10	WordPress Smart Custom FIelds plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22309	medium	6.5/10	WordPress SpeakOut! Email Petitions plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22310	medium	6.5/10	WordPress TemplatesNext ToolKit plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22315	medium	6.5/10	WordPress Typing Text plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22312	medium	6.5/10	WordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22316	medium	5.9/10	WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22320	high	7.1/10	WordPress ProductDyno plugin <= 1.0.24 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22323	medium	6.5/10	WordPress Image Hover Effects for Elementor plugin <= 1.0.2.4 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22321	medium	6.5/10	WordPress ElementsCSS Addons for Elementor plugin <= 1.0.8.9 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22324	high	7.1/10	WordPress OZ Canonical plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22325	high	7.1/10	WordPress Autocompleter plugin <= 1.3.5.2 - CSRF to Stored XSS vulnerability	Jan 7, 2025 1y ago
CVE-2025-22326	high	7.1/10	WordPress 5centsCDN plugin <= 25.4.15 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22328	high	7.1/10	WordPress Elevio plugin <= 4.4.1 - CSRF to Stored XSS vulnerability	Jan 7, 2025 1y ago
CVE-2025-22327	medium	6.5/10	WordPress EO4WP plugin <= 1.0.8.1 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22333	medium	6.5/10	WordPress Piotnet Addons For Elementor plugin <= 2.4.31 - Cross-Site Scripting vulnerability	Jan 7, 2025 1y ago
CVE-2025-22336	high	7.1/10	WordPress Wizhi Multi Filters by Wenprise plugin <= 1.8.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago
CVE-2025-22339	medium	6.5/10	WordPress Store Commerce theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability	Jan 7, 2025 1y ago