Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,014

All time

Critical · Active

12,268

CVSS ≥ 9.0

New · 14 days

2,264

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 11791–11820 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-51621	high	8.5/10	WordPress Download-Mirror-Counter plugin <= 1.1 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51625	high	8.5/10	WordPress Quran Shortcode plugin <= 1.5 - SQL Injection vulnerability	Nov 9, 2024 1y ago
CVE-2024-51782	high	7.1/10	WordPress Loginplus plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51783	high	7.1/10	WordPress Forms: 3rd-Party Post Again plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51784	high	7.1/10	WordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51786	medium	6.5/10	WordPress Realty by BestWebSoft plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51787	medium	6.5/10	WordPress ElementsReady Addons for Elementor plugin <= 6.4.3 - Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-51785	medium	4.4/10	WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability	Nov 9, 2024 1y ago
CVE-2024-10801	critical	9.8/10	WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload	Nov 9, 2024 1y ago
CVE-2024-10876	medium	6.1/10	Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting	Nov 9, 2024 1y ago
CVE-2024-8756	medium	5.3/10	Quform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information Exposure	Nov 9, 2024 1y ago
CVE-2024-10470	critical	9.8/10	WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion	Nov 9, 2024 1y ago
CVE-2024-8323	medium	6.4/10	Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute	Nov 6, 2024 1y ago
CVE-2024-10715	medium	6.4/10	MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block	Nov 6, 2024 1y ago
CVE-2024-10020	high	8.1/10	Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider	Nov 6, 2024 1y ago
CVE-2024-10647	medium	6.1/10	WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL	Nov 6, 2024 1y ago
CVE-2024-10028	high	7.5/10	Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log	Nov 5, 2024 1y ago
CVE-2024-10263	high	7.3/10	Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution	Nov 5, 2024 1y ago
CVE-2024-10114	high	8.1/10	Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider	Nov 5, 2024 1y ago
CVE-2024-10097	high	8.1/10	Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider	Nov 5, 2024 1y ago
CVE-2024-51677	medium	6.5/10	WordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51678	medium	6.5/10	WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51680	medium	6.5/10	WordPress Cresta Addons for Elementor plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51681	medium	6.5/10	WordPress WP Pocket URLs plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51682	medium	6.5/10	WordPress HT Builder – WordPress Theme Builder for Elementor plugin <= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51683	medium	6.5/10	WordPress Custom post type templates for Elementor plugin <= 1.10.1 - Stored Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51685	medium	5.9/10	WordPress Accordion title for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability	Nov 4, 2024 1y ago
CVE-2024-51626	high	8.5/10	WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability	Nov 4, 2024 1y ago
CVE-2024-51672	high	7.6/10	WordPress BetterLinks plugin <= 2.1.7 - SQL Injection vulnerability	Nov 4, 2024 1y ago
CVE-2024-50528	high	7.5/10	WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Sensitive Data Exposure vulnerability	Nov 4, 2024 1y ago