Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,394

All time

Critical · Active

11,074

CVSS ≥ 9.0

New · 14 days

3,184

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 11221–11250 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-52430	critical	9.8/10	WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability	Nov 18, 2024 1y ago
CVE-2024-52432	critical	9.8/10	WordPress NIX Anti-Spam Light plugin <= 0.0.4 - PHP Object Injection vulnerability	Nov 18, 2024 1y ago
CVE-2024-52433	critical	9.8/10	WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability	Nov 18, 2024 1y ago
CVE-2024-52427	critical	9.9/10	WordPress Event Tickets with Ticket Scanner plugin <= 2.3.11 - Remote Code Execution (RCE) vulnerability	Nov 18, 2024 1y ago
CVE-2024-52429	critical	9.9/10	WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability	Nov 18, 2024 1y ago
CVE-2024-52434	critical	9.1/10	WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code Execution (RCE) vulnerability	Nov 18, 2024 1y ago
CVE-2024-5030	—	—	CM Table Of Contents – WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF	Nov 18, 2024 1y ago
CVE-2024-52397	critical	9.1/10	WordPress Convert Docx2post plugin <= 1.4 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52398	critical	9.1/10	WordPress CDI plugin <= 5.5.3 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52399	critical	9.9/10	WordPress Writer Helper plugin <= 3.1.6 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52400	critical	9.9/10	WordPress Gallerio plugin <= 1.01 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52403	critical	9.9/10	WordPress User Management plugin <= 1.1 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52404	critical	9.9/10	WordPress CF7 Reply Manager plugin <= 1.2.3 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52405	critical	9.9/10	WordPress B-Banner Slider plugin <= 1.1 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52406	critical	9.9/10	WordPress CSV to html plugin <= 3.26 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52407	critical	9.9/10	WordPress BasePress Migration Tools plugin <= 1.0.0 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52408	critical	9.9/10	WordPress Push Notifications for WordPress by PushAssist plugin <= 3.0.8 - Arbitrary File Upload vulnerability	Nov 16, 2024 1y ago
CVE-2024-52409	critical	9.8/10	WordPress AJAX Random Posts plugin <= 0.3.3 - PHP Object Injection vulnerability	Nov 16, 2024 1y ago
CVE-2024-52410	critical	9.8/10	WordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerability	Nov 16, 2024 1y ago
CVE-2024-52411	critical	9.8/10	WordPress Advanced Personalization plugin <= 1.1.2 - PHP Object Injection vulnerability	Nov 16, 2024 1y ago
CVE-2024-52412	critical	9.8/10	WordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerability	Nov 16, 2024 1y ago
CVE-2024-52413	critical	9.8/10	WordPress Airin Blog theme <= 1.6.1 - PHP Object Injection vulnerability	Nov 16, 2024 1y ago
CVE-2024-52414	critical	9.8/10	WordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerability	Nov 16, 2024 1y ago
CVE-2024-52386	medium	5.3/10	WordPress Classified Listing plugin <= 3.1.16 - Local File Inclusion vulnerability	Nov 16, 2024 1y ago
CVE-2024-52415	high	8.8/10	WordPress SK WP Settings Backup plugin <= 1.0 - CSRF to PHP Object Injection vulnerability	Nov 16, 2024 1y ago
CVE-2024-52416	critical	10.0/10	WordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerability	Nov 16, 2024 1y ago
CVE-2024-10015	medium	6.4/10	ConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type Parameter	Nov 16, 2024 1y ago
CVE-2024-10104	—	—	Jobs for WordPress < 2.7.8 - Contributor+ Stored XSS	Nov 15, 2024 1y ago
CVE-2024-51658	high	7.1/10	WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability	Nov 14, 2024 1y ago
CVE-2024-51659	high	7.1/10	WordPress Twitter @Anywhere Plus plugin <= 2.0 - CSRF to Stored XSS vulnerability	Nov 14, 2024 1y ago