Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,018

All time

Critical · Active

12,270

CVSS ≥ 9.0

New · 14 days

2,207

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 12181–12210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-49306	medium	4.3/10	WordPress WP Content Copy Protection & No Right Click plugin <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49627	medium	4.3/10	WordPress WordPress Image SEO plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49628	medium	4.3/10	WordPress Most And Least Read Posts Widget plugin <= 2.5.18 - Cross Site Request Forgery (CSRF) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49335	high	7.1/10	WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49605	high	7.1/10	WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerability	Oct 20, 2024 1y ago
CVE-2024-49629	high	7.1/10	WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerability	Oct 20, 2024 1y ago
CVE-2024-47325	high	8.5/10	WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49609	high	8.5/10	WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49612	high	8.5/10	WordPress SW Contact Form plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49613	high	8.5/10	WordPress Simple Code Insert Shortcode plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49614	high	8.5/10	WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49615	high	8.2/10	WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49616	high	8.5/10	WordPress Rate Own Post plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49617	high	8.2/10	WordPress Back Link Tracker plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49618	high	8.5/10	WordPress MyTweetLinks plugin <= 1.1.1 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49619	high	8.5/10	WordPress Social Link Groups plugin <= 1.1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49620	high	8.5/10	WordPress FERMA.ru.net plugin <= 1.3.3 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-44061	high	7.1/10	WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability	Oct 20, 2024 1y ago
CVE-2024-49621	high	8.2/10	WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49622	high	8.2/10	WordPress Apa Banner Slider plugin <= 1.0.0 - CSRF to SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49623	high	8.5/10	WordPress Duplicate Title Validate plugin <= 1.0 - SQL Injection vulnerability	Oct 20, 2024 1y ago
CVE-2024-49608	high	8.8/10	WordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerability	Oct 20, 2024 1y ago
CVE-2024-49324	critical	10.0/10	WordPress Sovratec Case Management plugin <= 1.0.0 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago
CVE-2024-49326	critical	10.0/10	WordPress Affiliator plugin <= 2.1.3 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago
CVE-2024-49327	critical	10.0/10	WordPress Woostagram Connect plugin <= 1.0.2 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago
CVE-2024-49329	critical	10.0/10	WordPress WP REST API FNS plugin <= 1.0.0 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago
CVE-2024-49330	critical	10.0/10	WordPress Nice Backgrounds plugin <= 1.0 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago
CVE-2024-49331	critical	9.9/10	WordPress Property Lot Management System plugin <= 4.2.38 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago
CVE-2024-49607	critical	10.0/10	WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago
CVE-2024-49610	critical	10.0/10	WordPress photokit plugin <= 1.0 - Arbitrary File Upload vulnerability	Oct 20, 2024 1y ago