Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,002

All time

Critical · Active

12,268

CVSS ≥ 9.0

New · 14 days

2,354

Newly disclosed

Feed last synced

49 mins ago

Data freshness

Showing 11191–11220 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-53817	high	7.6/10	WordPress Acowebs Product Labels For Woocommerce plugin <= 1.5.8 - SQL Injection vulnerability	Dec 6, 2024 1y ago
CVE-2024-53804	high	7.5/10	WordPress WP Mailster plugin <= 1.8.16.0 - Sensitive Data Exposure vulnerability	Dec 6, 2024 1y ago
CVE-2024-53811	medium	6.6/10	WordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerability	Dec 6, 2024 1y ago
CVE-2024-53824	high	7.5/10	WordPress All Bootstrap Blocks plugin <= 1.3.20 - Local File Inclusion vulnerability	Dec 6, 2024 1y ago
CVE-2024-53805	high	7.5/10	WordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerability	Dec 6, 2024 1y ago
CVE-2024-11336	medium	6.1/10	Clickbank WordPress Plugin (Storefront) <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting	Dec 6, 2024 1y ago
CVE-2024-54221	critical	9.3/10	WordPress FAT Services Booking plugin <= 5.6 - Unauthenticated SQL Injection vulnerability	Dec 4, 2024 1y ago
CVE-2024-11854	medium	6.4/10	Listdom – Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter	Dec 4, 2024 1y ago
CVE-2024-11293	high	8.1/10	Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login <= 1.7.9 - Authentication Bypass via WordPress.com OAuth provider	Dec 4, 2024 1y ago
CVE-2024-12099	medium	4.3/10	Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure	Dec 4, 2024 1y ago
CVE-2024-11453	medium	6.4/10	WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 3, 2024 1y ago
CVE-2024-10484	medium	6.4/10	Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget	Dec 3, 2024 1y ago
CVE-2024-52452	high	7.1/10	WordPress Open edX LMS plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-51900	medium	5.9/10	WordPress What Would Seth Godin Do plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52453	high	7.1/10	WordPress Library Bookshelves plugin <= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52455	high	7.1/10	WordPress GoQSmile plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52454	high	7.1/10	WordPress GoQMieruca plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52457	high	7.1/10	WordPress Youneeq Recommendations plugin <= 3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52456	high	7.1/10	WordPress Awesome Studio plugin <= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52459	high	7.1/10	WordPress Chameleoni Jobs plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52458	high	7.1/10	WordPress TM Islamic Helper plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52460	high	7.1/10	WordPress AtaraPay WooCommerce Payment Gateway plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52462	high	7.1/10	WordPress WP e-Commerce Style Email plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52461	high	7.1/10	WordPress Infinite Slider plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52464	high	7.1/10	WordPress amr shortcodes plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52463	high	7.1/10	WordPress Post By Email plugin <= 1.0.4b - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52466	high	7.1/10	WordPress Explara Events plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52465	high	7.1/10	WordPress LGPD Framework plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52468	high	7.1/10	WordPress LeadBoxer plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago
CVE-2024-52467	high	7.1/10	WordPress AI Responsive Gallery Album plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 2, 2024 1y ago