Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,419

All time

Critical · Active

11,077

CVSS ≥ 9.0

New · 14 days

3,101

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 12361–12390 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-43329	medium	6.5/10	WordPress Allegiant theme <= 1.2.7 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43330	high	7.1/10	WordPress PowerPack for Beaver Builder plugin < 2.37.4 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43335	medium	6.5/10	WordPress Responsive Blocks – WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43238	high	7.1/10	WordPress weMail plugin <= 1.14.5 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-39666	medium	5.9/10	WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43276	high	7.1/10	WordPress Child Theme Creator by Orbisius plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43342	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43344	medium	6.5/10	WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43346	medium	6.5/10	WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43347	medium	5.9/10	WordPress Button contact VR plugin <= 4.7.3 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43348	high	7.1/10	WordPress Purity Of Soul theme <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43349	medium	6.5/10	WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43351	medium	6.5/10	WordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43352	medium	6.5/10	WordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43353	medium	6.5/10	WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-7301	high	7.2/10	WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload	Aug 16, 2024 1y ago
CVE-2024-43165	medium	6.5/10	WordPress WPSection plugin <= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43160	critical	10.0/10	WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability	Aug 13, 2024 1y ago
CVE-2024-43153	critical	9.8/10	WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability	Aug 13, 2024 1y ago
CVE-2024-43141	critical	9.8/10	WordPress Participants Database plugin <= 2.5.9.2 - PHP Object Injection vulnerability	Aug 13, 2024 1y ago
CVE-2024-43140	high	7.5/10	WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43138	medium	6.5/10	WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43135	high	7.5/10	WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43131	high	7.5/10	WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43129	medium	6.5/10	WordPress BetterDocs plugin <= 3.5.8 - Local File Inclusion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43128	medium	6.5/10	WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerability	Aug 13, 2024 1y ago
CVE-2024-43121	critical	9.1/10	WordPress HUSKY plugin <= 1.3.6.1 - Privilege Escalation vulnerability	Aug 13, 2024 1y ago
CVE-2024-39651	high	8.6/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability	Aug 13, 2024 1y ago
CVE-2024-39642	medium	6.5/10	WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability	Aug 13, 2024 1y ago
CVE-2024-38787	high	7.5/10	WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability	Aug 13, 2024 1y ago