Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,412

All time

Critical · Active

11,077

CVSS ≥ 9.0

New · 14 days

3,148

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 11731–11760 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-50467	medium	6.5/10	WordPress Scrollbar by webxapp plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50468	medium	6.5/10	WordPress Raptor Editor plugin <= 1.0.20 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50469	medium	6.5/10	WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50443	medium	6.5/10	WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50470	medium	6.5/10	WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50471	medium	6.5/10	WordPress Trip Plan plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50472	medium	6.5/10	WordPress Amilia Store plugin <= 2.9.8 - Stored Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50501	medium	6.5/10	WordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50502	medium	6.5/10	WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50465	high	8.5/10	WordPress Premium SEO Pack plugin <= 1.6.001 - SQL Injection vulnerability	Oct 28, 2024 1y ago
CVE-2024-50479	critical	9.3/10	WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability	Oct 28, 2024 1y ago
CVE-2024-50491	critical	9.3/10	WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability	Oct 28, 2024 1y ago
CVE-2024-50497	high	8.1/10	WordPress Advanced Online Ordering and Delivery Platform plugin <= 2.0.0 - Local File Inclusion vulnerability	Oct 28, 2024 1y ago
CVE-2024-50463	medium	4.7/10	WordPress Sunshine Photo Cart plugin <= 3.2.9 - Open Redirection vulnerability	Oct 28, 2024 1y ago
CVE-2024-50478	critical	9.8/10	WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability	Oct 28, 2024 1y ago
CVE-2024-50483	critical	9.8/10	WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability	Oct 28, 2024 1y ago
CVE-2024-50488	high	8.8/10	WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability	Oct 28, 2024 1y ago
CVE-2024-50408	high	8.8/10	WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability	Oct 28, 2024 1y ago
CVE-2024-50416	high	8.8/10	WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability	Oct 28, 2024 1y ago
CVE-2024-50450	high	7.3/10	WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability	Oct 28, 2024 1y ago
CVE-2024-50492	high	8.3/10	WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50498	critical	10.0/10	WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50477	critical	9.8/10	WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability	Oct 28, 2024 1y ago
CVE-2024-50486	critical	9.8/10	WordPress Acnoo Flutter API plugin <= 1.0.5 - Account Takeover vulnerability	Oct 28, 2024 1y ago
CVE-2024-50487	critical	9.8/10	WordPress MaanStore API plugin <= 1.0.1 - Account Takeover vulnerability	Oct 28, 2024 1y ago
CVE-2024-50489	critical	9.8/10	WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability	Oct 28, 2024 1y ago
CVE-2024-50442	medium	6.5/10	WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability	Oct 28, 2024 1y ago
CVE-2024-9501	critical	9.8/10	Wp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider	Oct 26, 2024 1y ago
CVE-2024-8392	high	7.2/10	WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion	Oct 26, 2024 1y ago
CVE-2024-9488	critical	9.8/10	Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider	Oct 25, 2024 1y ago