Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,401

All time

Critical · Active

11,075

CVSS ≥ 9.0

New · 14 days

3,162

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 11401–11430 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-50544	high	8.5/10	WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51570	high	8.5/10	WordPress Easy Gallery plugin <= 1.4 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51579	high	8.5/10	WordPress 5 Stars Rating Funnel plugin <=1.4.01 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51601	high	8.5/10	WordPress Website price calculator plugin <= 4.1 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51602	high	8.5/10	WordPress Simple Job Manager plugin <= 1.1 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51607	high	8.5/10	WordPress Golf Tracker plugin <= 0.7 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51619	high	8.5/10	WordPress Market 360 Viewer plugin <= 1.01 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51620	high	8.5/10	WordPress Porsline plugin <= 1.0.2 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51621	high	8.5/10	WordPress Download-Mirror-Counter plugin <= 1.1 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51625	high	8.5/10	WordPress Quran Shortcode plugin <= 1.5 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51782	high	7.1/10	WordPress Loginplus plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51783	high	7.1/10	WordPress Forms: 3rd-Party Post Again plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51784	high	7.1/10	WordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51786	medium	6.5/10	WordPress Realty by BestWebSoft plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51787	medium	6.5/10	WordPress ElementsReady Addons for Elementor plugin <= 6.4.3 - Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51785	medium	4.4/10	WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability	Nov 9, 2024 1y ago
CVE-2024-10801	critical	9.8/10	WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload	Nov 9, 2024 1y ago
CVE-2024-10876	medium	6.1/10	Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting	Nov 9, 2024 1y ago
CVE-2024-8756	medium	5.3/10	Quform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information Exposure	Nov 9, 2024 1y ago
CVE-2024-10470	critical	9.8/10	WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion	Nov 9, 2024 1y ago
CVE-2024-8323	medium	6.4/10	Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute	Nov 6, 2024 1y ago
CVE-2024-10715	medium	6.4/10	MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block	Nov 6, 2024 1y ago
CVE-2024-10020	high	8.1/10	Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider	Nov 6, 2024 1y ago
CVE-2024-10647	medium	6.1/10	WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL	Nov 6, 2024 1y ago
CVE-2024-10028	high	7.5/10	Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log	Nov 5, 2024 1y ago
CVE-2024-10263	high	7.3/10	Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution	Nov 5, 2024 1y ago
CVE-2024-10114	high	8.1/10	Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider	Nov 5, 2024 1y ago
CVE-2024-10097	high	8.1/10	Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider	Nov 5, 2024 1y ago
CVE-2024-51677	medium	6.5/10	WordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51678	medium	6.5/10	WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago