Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

355,524

All time

Critical · Active

12,683

CVSS ≥ 9.0

New · 14 days

2,041

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1051–1080 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42656	medium	6.5/10	WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42655	high	7.5/10	WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42651	medium	6.3/10	WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42650	high	7.2/10	WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42649	high	7.1/10	WordPress Favicon Rotator plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42640	medium	6.5/10	WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42639	critical	9.3/10	WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42411	high	8.1/10	WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42386	critical	9.3/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42384	high	7.5/10	WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42381	critical	9.3/10	WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-42378	medium	6.5/10	WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability	Jun 15, 2026 4mo ago
CVE-2026-41556	medium	6.5/10	WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40799	medium	5.8/10	WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40798	critical	9.3/10	WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40796	medium	6.5/10	WordPress WPPizza plugin <= 3.19.9 - Sensitive Data Exposure vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40795	medium	6.5/10	WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40794	medium	6.5/10	WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40793	medium	6.5/10	WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40792	medium	6.3/10	WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40791	high	7.1/10	WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40790	medium	6.5/10	WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40789	high	7.5/10	WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40788	high	7.1/10	WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40787	high	7.1/10	WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40785	high	7.1/10	WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40782	medium	6.5/10	WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40781	high	7.5/10	WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40779	high	7.7/10	WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability	Jun 15, 2026 4mo ago
CVE-2026-40776	high	7.5/10	WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago