Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1051–1080 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-39494	critical	9.3/10	WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability	Jun 11, 2026 2mo ago
CVE-2026-42647	critical	9.3/10	WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability	Jun 11, 2026 2mo ago
CVE-2026-49060	critical	9.8/10	WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability	Jun 11, 2026 2mo ago
CVE-2023-32959	medium	4.3/10	WordPress MetroStore theme <= 1.3.2 - Broken Access Control	Jun 11, 2026 2mo ago
CVE-2023-25969	medium	5.4/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability	Jun 11, 2026 2mo ago
CVE-2022-47150	medium	4.3/10	WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability	Jun 11, 2026 2mo ago
CVE-2022-45813	medium	5.4/10	WordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRF	Jun 11, 2026 2mo ago
CVE-2022-44630	medium	4.6/10	WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)	Jun 11, 2026 2mo ago
CVE-2022-42479	medium	5.4/10	WordPress Soledad premium theme <= 8.2.5 - Broken Access Control vulnerability	Jun 11, 2026 2mo ago
CVE-2023-40200	medium	5.3/10	WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability	Jun 11, 2026 2mo ago
CVE-2024-32110	medium	4.3/10	WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.1.2 - Cross Site Request Forgery (CSRF) vulnerability	Jun 11, 2026 2mo ago
CVE-2023-33999	high	7.1/10	WordPress WP Mail Log plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 11, 2026 2mo ago
CVE-2026-49069	high	7.1/10	WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability	Jun 10, 2026 2mo ago
CVE-2017-20251	critical	9.3/10	WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API	Jun 9, 2026 2mo ago
CVE-2017-20250	high	8.7/10	WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download	Jun 9, 2026 2mo ago
CVE-2017-20249	high	8.8/10	WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection	Jun 9, 2026 2mo ago
CVE-2017-20248	high	8.7/10	WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download	Jun 9, 2026 2mo ago
CVE-2017-20247	high	8.8/10	WordPress Plugin PICA Photo Gallery 1.0 SQL Injection	Jun 9, 2026 2mo ago
CVE-2017-20246	high	8.8/10	KittyCatfish 2.2 Plugin for WordPress SQL Injection	Jun 9, 2026 2mo ago
CVE-2017-20245	high	8.8/10	Wow Viral Signups 2.1 WordPress Plugin SQL Injection	Jun 9, 2026 2mo ago
CVE-2017-20244	high	8.8/10	Wow Forms WordPress Plugin 2.1 SQL Injection	Jun 9, 2026 2mo ago
CVE-2017-20243	high	8.8/10	WordPress Car Park Booking Plugin SQL Injection via space_id	Jun 9, 2026 2mo ago
CVE-2016-20065	high	8.8/10	Product Catalog 8 1.2 Plugin WordPress SQL Injection	Jun 9, 2026 2mo ago
CVE-2016-20063	high	7.1/10	Single Personal Message 1.0.3 WordPress Plugin SQL Injection	Jun 9, 2026 2mo ago
CVE-2016-20062	high	8.8/10	Simply Poll 1.4.1 Plugin for WordPress SQL Injection	Jun 9, 2026 2mo ago
CVE-2024-58349	critical	9.3/10	WordPress Theme Travelscape 1.0.3 Arbitrary File Upload	Jun 8, 2026 2mo ago
CVE-2024-58348	critical	9.3/10	WordPress Background Image Cropper 1.2 Remote Code Execution	Jun 8, 2026 2mo ago
CVE-2023-54352	critical	9.3/10	WordPress Seotheme Remote Code Execution Unauthenticated	Jun 8, 2026 2mo ago
CVE-2023-54351	medium	5.1/10	WordPress Sonaar Music Plugin 4.7 Stored XSS via Comments	Jun 8, 2026 2mo ago
CVE-2023-54350	high	8.7/10	WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated	Jun 8, 2026 2mo ago