Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,419

All time

Critical · Active

11,077

CVSS ≥ 9.0

New · 14 days

3,129

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 12181–12210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-44050	medium	6.5/10	WordPress Verbosa theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago
CVE-2024-44051	medium	6.5/10	WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago
CVE-2024-45451	medium	6.5/10	WordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago
CVE-2024-45452	medium	6.5/10	WordPress Septera theme <= 1.5.1 - Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago
CVE-2024-22303	high	8.8/10	WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability	Sep 17, 2024 1y ago
CVE-2024-21743	high	8.8/10	WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability	Sep 17, 2024 1y ago
CVE-2024-44053	high	7.1/10	WordPress Opor Ayam theme <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44054	medium	6.5/10	WordPress Fluida theme <= 1.8.8 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44056	medium	6.5/10	WordPress Mantra theme <= 3.3.2 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44057	medium	6.5/10	WordPress Nirvana theme <= 1.6.3 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44058	medium	6.5/10	WordPress Parabola theme <= 2.4.1 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44059	medium	6.5/10	WordPress Custom Query Blocks plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44060	high	7.1/10	WordPress filmix theme <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44062	medium	6.5/10	WordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-44063	medium	6.5/10	WordPress Happyforms plugin <= 1.26.0 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-45455	medium	5.9/10	WordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-45456	medium	6.5/10	WordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-45457	medium	6.5/10	WordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-45458	high	7.1/10	WordPress Spiffy Calendar plugin <= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-45459	high	7.1/10	WordPress Product Slider for WooCommerce by PickPlugins plugin <= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-45460	medium	5.9/10	WordPress Flipping Cards plugin <= 1.30 - Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-8714	medium	6.1/10	WordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site Scripting	Sep 13, 2024 1y ago
CVE-2024-5567	medium	6.4/10	Betheme \| Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File	Sep 13, 2024 1y ago
CVE-2024-5628	medium	6.4/10	Avada \| Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode	Sep 13, 2024 1y ago
CVE-2024-8529	critical	10.0/10	LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'	Sep 12, 2024 1y ago
CVE-2024-8522	critical	10.0/10	LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'	Sep 12, 2024 1y ago
CVE-2024-5799	—	—	CM Pop-Up Banners for WordPress < 1.7.3 - Contributor+ Stored XSS	Sep 12, 2024 1y ago
CVE-2024-8045	medium	6.4/10	Advanced WordPress Backgrounds <= 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via imageTag Parameter	Sep 11, 2024 1y ago
CVE-2024-7770	high	8.8/10	Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload	Sep 10, 2024 1y ago
CVE-2024-8427	medium	4.3/10	Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Sep 6, 2024 1y ago