Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

353,672

All time

Critical · Active

12,527

CVSS ≥ 9.0

New · 14 days

1,373

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 10681–10710 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-54422	high	7.1/10	WordPress Evernote Sync plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-55973	high	8.5/10	WordPress TSB Occasion Editor plugin <= 1.2.1 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55972	critical	9.3/10	WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55974	high	8.5/10	WordPress Mimoos plugin <= 1.2 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55977	critical	9.3/10	WordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55976	critical	9.3/10	WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55978	critical	9.3/10	WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55980	critical	9.3/10	WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55979	high	8.5/10	WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55982	critical	9.3/10	WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55981	critical	9.3/10	WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55986	high	8.5/10	WordPress Service plugin <= 1.0.4 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55988	critical	9.3/10	WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55987	high	8.5/10	WordPress Advanced What should we write next about plugin <= 1.0.3 - SQL Injection vulnerability	Dec 16, 2024 1y ago
CVE-2024-55996	medium	6.1/10	WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-56013	high	8.8/10	WordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerability	Dec 16, 2024 1y ago
CVE-2024-54384	medium	4.3/10	WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.8.3 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-55992	medium	5.4/10	WordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-54417	medium	5.3/10	WordPress PixProof plugin <= 2.0.1 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-55993	medium	5.3/10	WordPress Job Board Manager plugin <= 2.1.61 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-56001	medium	6.5/10	WordPress Ksher plugin <= 1.1.1 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-55994	medium	4.3/10	WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-56007	medium	4.3/10	WordPress Leader plugin <= 2.6.1 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-56009	medium	5.3/10	WordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-54360	medium	6.5/10	WordPress Gutensee plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54442	medium	5.9/10	WordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54441	medium	6.5/10	WordPress Utech World Time Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54443	medium	6.5/10	WordPress Advanced Data Table For Elementor plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-56011	medium	6.5/10	WordPress Responsive Google Maps \| by imbaa plugin <= 1.2.5 - Stored Cross Site Scripting (XSS) vulnerability	Dec 16, 2024 1y ago
CVE-2024-54331	high	7.1/10	WordPress I Plant A Tree plugin <= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerability	Dec 16, 2024 1y ago