Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

353,671

All time

Critical · Active

12,527

CVSS ≥ 9.0

New · 14 days

1,389

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 10621–10650 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-56055	high	8.5/10	WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability	Dec 18, 2024 1y ago
CVE-2024-56051	high	8.5/10	WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability	Dec 18, 2024 1y ago
CVE-2024-52485	medium	6.5/10	WordPress WP Menu Image plugin <= 2.2 - Broken Access Control vulnerability	Dec 18, 2024 1y ago
CVE-2024-55997	medium	6.5/10	WordPress Order Delivery & Pickup Location Date Time plugin <= 1.1.0 - Settings Change vulnerability	Dec 18, 2024 1y ago
CVE-2024-51646	high	7.1/10	WordPress Saoshyant Element plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 18, 2024 1y ago
CVE-2024-49677	high	7.1/10	WordPress Bootstrap Buttons plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 18, 2024 1y ago
CVE-2024-56010	high	7.1/10	WordPress Device Detector Plugin <= 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 18, 2024 1y ago
CVE-2024-54350	high	7.1/10	WordPress hmd theme <= 2.0 - Cross Site Scripting (XSS) vulnerability	Dec 18, 2024 1y ago
CVE-2024-56016	high	7.1/10	WordPress Image Mapper plugin <= 0.2.5.3 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 18, 2024 1y ago
CVE-2024-55975	high	8.5/10	WordPress Dr Affiliate plugin <= 1.2.3 - SQL Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-55984	high	8.5/10	WordPress Saksh Escrow System plugin <= 2.4 - SQL Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-55983	high	8.5/10	WordPress PowerFormBuilder plugin <= 1.0.6 - SQL Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-55985	high	8.5/10	WordPress YDS Support Ticket System plugin <= 1.0 - SQL Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-56058	critical	9.8/10	WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-54270	high	8.1/10	WordPress Axeptio plugin <= 2.5.4 - Local File Inclusion vulnerability	Dec 18, 2024 1y ago
CVE-2024-56059	critical	9.8/10	WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability	Dec 18, 2024 1y ago
CVE-2024-56008	high	7.5/10	WordPress Spreadr Woocommerce plugin <= 1.0.4 - Arbitrary Content Deletion vulnerability	Dec 18, 2024 1y ago
CVE-2024-12259	high	8.8/10	CRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation	Dec 18, 2024 1y ago
CVE-2024-12127	medium	6.1/10	Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter	Dec 17, 2024 1y ago
CVE-2024-12443	medium	6.4/10	CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 16, 2024 1y ago
CVE-2024-56017	high	7.1/10	WordPress Stop Registration Spam Plugin <= 1.23 - CSRF to Stored XSS vulnerability	Dec 16, 2024 1y ago
CVE-2024-54357	medium	4.3/10	WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54376	high	7.5/10	WordPress EazyDocs plugin <= 2.8.0 - Local File Inclusion vulnerability	Dec 16, 2024 1y ago
CVE-2024-56003	medium	4.3/10	WordPress Caldera SMTP Mailer plugin <= 1.0.1 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-55999	medium	5.3/10	WordPress XML Multilanguage Sitemap Generator plugin <= 2.0.6 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-54348	medium	6.5/10	WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54285	critical	9.1/10	WordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54284	high	7.6/10	WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-54283	high	7.6/10	WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-54280	critical	9.3/10	WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability	Dec 16, 2024 1y ago