Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,417

All time

Critical · Active

11,077

CVSS ≥ 9.0

New · 14 days

3,128

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 12121–12150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-8632	medium	6.5/10	KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure	Oct 1, 2024 1y ago
CVE-2024-8548	high	8.1/10	KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions	Oct 1, 2024 1y ago
CVE-2024-47396	medium	6.5/10	WordPress Move Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2024 1y ago
CVE-2024-47641	medium	6.5/10	WordPress Confetti Fall Animation plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Sep 30, 2024 1y ago
CVE-2024-9049	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module	Sep 27, 2024 1y ago
CVE-2024-8771	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure	Sep 26, 2024 1y ago
CVE-2022-4541	high	7.2/10	WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header	Sep 26, 2024 1y ago
CVE-2024-47337	medium	4.3/10	WordPress Joy Of Text Lite plugin <= 2.3.1 - Broken Access Control vulnerability	Sep 26, 2024 1y ago
CVE-2024-47330	medium	4.3/10	Broken Access Control vulnerability on multiple WordPress plugins by Supsystic	Sep 26, 2024 1y ago
CVE-2024-47305	medium	4.3/10	WordPress Use Any Font plugin <= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerability	Sep 25, 2024 1y ago
CVE-2024-47315	medium	5.4/10	WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability	Sep 25, 2024 1y ago
CVE-2024-43237	medium	5.3/10	WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerability	Sep 25, 2024 1y ago
CVE-2024-43990	medium	5.3/10	WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability	Sep 25, 2024 1y ago
CVE-2024-43959	high	7.1/10	WordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 25, 2024 1y ago
CVE-2024-47303	medium	6.5/10	WordPress Elementor Addons by Livemesh plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability	Sep 25, 2024 1y ago
CVE-2024-8658	medium	5.3/10	myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade	Sep 25, 2024 1y ago
CVE-2024-7385	critical	9.1/10	WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection	Sep 25, 2024 1y ago
CVE-2024-9073	medium	6.4/10	GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	Sep 25, 2024 1y ago
CVE-2024-8434	medium	4.3/10	Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates	Sep 25, 2024 1y ago
CVE-2024-9069	medium	6.4/10	Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	Sep 25, 2024 1y ago
CVE-2024-8436	critical	9.9/10	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection	Sep 24, 2024 1y ago
CVE-2024-8437	medium	4.3/10	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation	Sep 24, 2024 1y ago
CVE-2024-8267	medium	6.4/10	Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Sep 24, 2024 1y ago
CVE-2024-8791	critical	9.8/10	Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation	Sep 24, 2024 1y ago
CVE-2024-45453	low	3.7/10	WordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability	Sep 23, 2024 1y ago
CVE-2024-44048	medium	6.5/10	WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability	Sep 23, 2024 1y ago
CVE-2024-43996	medium	6.5/10	WordPress ElementsKit Pro plugin <= 3.6.0 - Local File Inclusion vulnerability	Sep 23, 2024 1y ago
CVE-2024-43989	high	7.5/10	WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability	Sep 22, 2024 1y ago
CVE-2024-8680	medium	4.4/10	MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting	Sep 21, 2024 1y ago
CVE-2024-8850	medium	6.1/10	MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting	Sep 19, 2024 1y ago