Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

355,538

All time

Critical · Active

12,683

CVSS ≥ 9.0

New · 14 days

2,048

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1141–1170 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-39434	high	7.2/10	WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-34902	high	7.1/10	WordPress WooCommerce Product Table Lite plugin <= 4.6.3 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-34901	critical	9.8/10	WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability	Jun 15, 2026 4mo ago
CVE-2026-34900	high	7.1/10	WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2026-34898	high	7.5/10	WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-34892	medium	6.5/10	WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-34891	high	7.5/10	WordPress IDPay Payment Gateway for Woocommerce plugin <= 2.2.5 - Sensitive Data Exposure vulnerability	Jun 15, 2026 4mo ago
CVE-2026-34886	high	7.5/10	WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-27407	high	7.2/10	WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability	Jun 15, 2026 4mo ago
CVE-2026-27333	high	8.1/10	WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability	Jun 15, 2026 4mo ago
CVE-2026-27089	high	7.5/10	WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability	Jun 15, 2026 4mo ago
CVE-2026-27053	critical	9.8/10	WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-25440	medium	5.3/10	WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-25425	high	7.5/10	WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-24637	high	8.5/10	WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-9691	critical	9.8/10	WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability	Jun 15, 2026 4mo ago
CVE-2026-23970	high	7.1/10	WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2025-69332	medium	6.5/10	WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2025-68872	high	7.1/10	WordPress Eli's WordCents adSense Widget with Analytics plugin <= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2025-68851	high	7.1/10	WordPress Okay Toolkit plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2025-68840	high	7.1/10	WordPress iRobots.txt SEO plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2025-68049	medium	6.3/10	WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2025-60175	medium	4.4/10	WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability	Jun 15, 2026 4mo ago
CVE-2025-59133	high	7.5/10	WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability	Jun 15, 2026 4mo ago
CVE-2025-15659	medium	6.5/10	WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2025-15658	medium	5.9/10	WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 4mo ago
CVE-2025-64215	medium	6.5/10	WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-49064	high	7.5/10	WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability	Jun 15, 2026 4mo ago
CVE-2026-48969	medium	6.5/10	WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability	Jun 15, 2026 4mo ago
CVE-2026-49111	high	8.8/10	WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability	Jun 15, 2026 4mo ago