Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

353,720

All time

Critical · Active

12,535

CVSS ≥ 9.0

New · 14 days

1,402

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 11581–11610 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-51924	medium	6.5/10	WordPress WP Agenda plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51923	medium	6.5/10	WordPress Websand Subscription Form plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51926	medium	6.5/10	WordPress GreenCon plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51925	medium	6.5/10	WordPress Testimonial Slider Shortcode plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51927	medium	6.5/10	WordPress Rig Elements For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51929	medium	6.5/10	WordPress Icon Widget plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51928	medium	6.5/10	WordPress Blocks Post Grid plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51931	medium	6.5/10	WordPress AzonBox plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51930	medium	6.5/10	WordPress Custom URL Shortener plugin <= 0.3.6 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51933	medium	6.5/10	WordPress Cookie Nonsense for YT plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51932	medium	6.5/10	WordPress Kings Tab Slider plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51935	medium	6.5/10	WordPress Fast Video and Image Display plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51934	medium	6.5/10	WordPress Ekiline Block Collection plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51937	medium	6.5/10	WordPress IA Map Analytics Basic plugin <= 20170413 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51936	medium	6.5/10	WordPress ESB Testimonials plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-51938	medium	6.5/10	WordPress Charity Addon for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability	Nov 19, 2024 1y ago
CVE-2024-49689	medium	5.4/10	WordPress HD Quiz – Save Results Light plugin <= 0.5 - Broken Access Control vulnerability	Nov 19, 2024 1y ago
CVE-2024-49680	medium	4.3/10	WordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability	Nov 19, 2024 1y ago
CVE-2024-49697	medium	4.3/10	WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability	Nov 19, 2024 1y ago
CVE-2024-51660	medium	4.3/10	WordPress Easy Accordion Gutenberg Block plugin <= 1.2.3 - Broken Access Control vulnerability	Nov 19, 2024 1y ago
CVE-2024-50417	medium	4.3/10	WordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerability	Nov 19, 2024 1y ago
CVE-2024-51817	medium	5.4/10	WordPress Combo WP Rewrite Slugs plugin <= 1.0 - Settings Change vulnerability	Nov 19, 2024 1y ago
CVE-2024-51671	low	2.7/10	WordPress Otter Blocks plugin <= 3.0.3 - Broken Access Control vulnerability	Nov 19, 2024 1y ago
CVE-2024-52395	medium	5.3/10	WordPress Floating Buttons for WooCommerce plugin <= 2.8.8 - Broken Access Control vulnerability	Nov 19, 2024 1y ago
CVE-2024-11036	high	7.3/10	GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings	Nov 19, 2024 1y ago
CVE-2024-10388	high	7.2/10	WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting	Nov 19, 2024 1y ago
CVE-2024-11069	medium	6.5/10	WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion	Nov 19, 2024 1y ago
CVE-2024-51939	medium	6.5/10	WordPress Stylish Internal Links plugin <= 1.9 - Cross Site Scripting (XSS) vulnerability	Nov 18, 2024 1y ago
CVE-2024-51940	medium	6.5/10	WordPress WP Responsive Video plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	Nov 18, 2024 1y ago
CVE-2024-52339	medium	6.5/10	WordPress Mage Front End Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability	Nov 18, 2024 1y ago