Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,413

All time

Critical · Active

11,077

CVSS ≥ 9.0

New · 14 days

3,146

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 11791–11820 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-49325	medium	4.3/10	WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerability	Oct 20, 2024 1y ago
CVE-2024-47634	medium	5.4/10	WordPress CartBounty plugin <= 8.2 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49250	medium	4.3/10	WordPress Table of Contents Plus plugin <= 2408 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49272	medium	4.3/10	WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49274	medium	5.4/10	WordPress VOD Infomaniak plugin <= 1.5.7 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49275	medium	4.3/10	WordPress IdeaPush plugin <= 8.69 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49290	medium	4.3/10	WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49306	medium	4.3/10	WordPress WP Content Copy Protection & No Right Click plugin <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49627	medium	4.3/10	WordPress WordPress Image SEO plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49628	medium	4.3/10	WordPress Most And Least Read Posts Widget plugin <= 2.5.18 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49335	high	7.1/10	WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49605	high	7.1/10	WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerability	Oct 20, 2024 1y ago
CVE-2024-49629	high	7.1/10	WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerability	Oct 20, 2024 1y ago
CVE-2024-47325	high	8.5/10	WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49609	high	8.5/10	WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49612	high	8.5/10	WordPress SW Contact Form plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49613	high	8.5/10	WordPress Simple Code Insert Shortcode plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49614	high	8.5/10	WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49615	high	8.2/10	WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49616	high	8.5/10	WordPress Rate Own Post plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49617	high	8.2/10	WordPress Back Link Tracker plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49618	high	8.5/10	WordPress MyTweetLinks plugin <= 1.1.1 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49619	high	8.5/10	WordPress Social Link Groups plugin <= 1.1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49620	high	8.5/10	WordPress FERMA.ru.net plugin <= 1.3.3 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-44061	high	7.1/10	WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49621	high	8.2/10	WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49622	high	8.2/10	WordPress Apa Banner Slider plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49623	high	8.5/10	WordPress Duplicate Title Validate plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49608	high	8.8/10	WordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerability	Oct 20, 2024 1y ago
CVE-2024-49324	critical	10.0/10	WordPress Sovratec Case Management plugin <= 1.0.0 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago