Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,417

All time

Critical · Active

11,077

CVSS ≥ 9.0

New · 14 days

3,134

Newly disclosed

Feed last synced

48 mins ago

Data freshness

Showing 12091–12120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-47642	medium	6.5/10	WordPress Keap Official Opt-in Forms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability	Oct 5, 2024 1y ago
CVE-2024-47643	medium	6.5/10	WordPress Include Fussball.de Widgets plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability	Oct 5, 2024 1y ago
CVE-2024-47644	high	7.1/10	WordPress Copyscape Premium plugin <= 1.3.9 - CSRF to Stored Cross-Site Scripting vulnerability	Oct 5, 2024 1y ago
CVE-2024-47646	medium	4.7/10	WordPress Payflex Payment Gateway plugin <= 2.6.1 - Open Redirection vulnerability	Oct 5, 2024 1y ago
CVE-2024-47647	medium	5.9/10	WordPress FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability	Oct 5, 2024 1y ago
CVE-2024-47324	high	7.5/10	WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-47323	high	8.1/10	WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-47319	high	8.0/10	WordPress Bit Form plugin <= 2.13.10 - Arbitrary File Upload vulnerability	Oct 5, 2024 1y ago
CVE-2024-47316	medium	4.3/10	WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability	Oct 5, 2024 1y ago
CVE-2024-47309	medium	6.6/10	WordPress Cities Shipping Zones for WooCommerce plugin <= 1.2.7 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44034	high	7.5/10	WordPress WPSPX plugin <= 1.0.2 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44023	high	8.1/10	WordPress ABCApp Creator plugin <= 1.1.2 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44018	high	7.5/10	WordPress Instant Chat WP plugin <= 1.0.5 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44016	high	7.5/10	WordPress Podiant plugin <= 1.1 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44015	high	7.5/10	WordPress Users Control plugin <= 1.0.16 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44014	critical	9.6/10	WordPress Vmax Project Manager plugin <= 1.0 - Local File Inclusion to RCE vulnerability	Oct 5, 2024 1y ago
CVE-2024-44013	high	7.5/10	WordPress VR Calendar plugin <= 2.4.0 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44012	high	7.5/10	WordPress WP Newsletter Subscription plugin <= 1.1 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44011	high	7.5/10	WordPress WP Ticket Ultra plugin <= 1.0.5 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-9146	medium	4.9/10	WordPress CSS JS Files plugin <= 1.5.0 - Directory Traversal to File Read vulnerability	Oct 5, 2024 1y ago
CVE-2024-8743	medium	6.8/10	Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload	Oct 5, 2024 1y ago
CVE-2024-9375	medium	6.1/10	WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting	Oct 4, 2024 1y ago
CVE-2024-8505	medium	6.4/10	WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter	Oct 2, 2024 1y ago
CVE-2024-8282	medium	6.4/10	Ibtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Oct 2, 2024 1y ago
CVE-2024-44017	high	7.5/10	WordPress MH Board plugin <= 1.3.2.1 - Local File Inclusion vulnerability	Oct 2, 2024 1y ago
CVE-2024-44030	high	7.2/10	WordPress Checkout Mestres WP plugin <= 8.6 - Local File Inclusion vulnerability	Oct 2, 2024 1y ago
CVE-2024-8254	medium	5.4/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution	Oct 2, 2024 1y ago
CVE-2024-9289	critical	9.8/10	WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation	Oct 1, 2024 1y ago
CVE-2024-8288	medium	6.4/10	Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Oct 1, 2024 1y ago
CVE-2024-9267	medium	6.1/10	Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter	Oct 1, 2024 1y ago