Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,076

All time

Critical · Active

11,054

CVSS ≥ 9.0

New · 14 days

3,007

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 10801–10830 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-54214	critical	10.0/10	WordPress Revy plugin <= 1.18 - Unauthenticated Arbitrary File Upload vulnerability	Dec 6, 2024 1y ago
CVE-2024-54216	high	7.7/10	WordPress ARForms plugin <= 6.4.1 - Subscriber+ Arbitrary File Read vulnerability	Dec 6, 2024 1y ago
CVE-2024-51815	critical	9.0/10	WordPress s2Member plugin <= 241114 - Remote Code Execution (RCE) vulnerability	Dec 6, 2024 1y ago
CVE-2024-53806	medium	5.4/10	WordPress Maspik plugin <= 2.2.7 - CSRF to Settings Change vulnerability	Dec 6, 2024 1y ago
CVE-2024-53809	medium	4.3/10	WordPress Namaste! LMS plugin <= 2.6.4.1 - Cross Site Request Forgery (CSRF) vulnerability	Dec 6, 2024 1y ago
CVE-2024-53807	high	8.5/10	WordPress WP Mailster plugin <= 1.8.16.0 - SQL Injection vulnerability	Dec 6, 2024 1y ago
CVE-2024-53808	high	8.5/10	WordPress NEX-Forms plugin <= 8.7.8 - SQL Injection vulnerability	Dec 6, 2024 1y ago
CVE-2024-53815	high	8.5/10	WordPress Pinpoint Booking System plugin <= 2.9.9.5.2 - SQL Injection vulnerability	Dec 6, 2024 1y ago
CVE-2024-53817	high	7.6/10	WordPress Acowebs Product Labels For Woocommerce plugin <= 1.5.8 - SQL Injection vulnerability	Dec 6, 2024 1y ago
CVE-2024-53804	high	7.5/10	WordPress WP Mailster plugin <= 1.8.16.0 - Sensitive Data Exposure vulnerability	Dec 6, 2024 1y ago
CVE-2024-53811	medium	6.6/10	WordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerability	Dec 6, 2024 1y ago
CVE-2024-53824	high	7.5/10	WordPress All Bootstrap Blocks plugin <= 1.3.20 - Local File Inclusion vulnerability	Dec 6, 2024 1y ago
CVE-2024-53805	high	7.5/10	WordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerability	Dec 6, 2024 1y ago
CVE-2024-11336	medium	6.1/10	Clickbank WordPress Plugin (Storefront) <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting	Dec 6, 2024 1y ago
CVE-2024-54221	critical	9.3/10	WordPress FAT Services Booking plugin <= 5.6 - Unauthenticated SQL Injection vulnerability	Dec 4, 2024 1y ago
CVE-2024-11854	medium	6.4/10	Listdom – Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter	Dec 4, 2024 1y ago
CVE-2024-11293	high	8.1/10	Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login <= 1.7.9 - Authentication Bypass via WordPress.com OAuth provider	Dec 4, 2024 1y ago
CVE-2024-12099	medium	4.3/10	Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure	Dec 4, 2024 1y ago
CVE-2024-11453	medium	6.4/10	WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 3, 2024 1y ago
CVE-2024-10484	medium	6.4/10	Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget	Dec 3, 2024 1y ago
CVE-2024-52452	high	7.1/10	WordPress Open edX LMS plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-51900	medium	5.9/10	WordPress What Would Seth Godin Do plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52453	high	7.1/10	WordPress Library Bookshelves plugin <= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52455	high	7.1/10	WordPress GoQSmile plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52454	high	7.1/10	WordPress GoQMieruca plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52457	high	7.1/10	WordPress Youneeq Recommendations plugin <= 3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52456	high	7.1/10	WordPress Awesome Studio plugin <= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52459	high	7.1/10	WordPress Chameleoni Jobs plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52458	high	7.1/10	WordPress TM Islamic Helper plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52460	high	7.1/10	WordPress AtaraPay WooCommerce Payment Gateway plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago