Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,549

All time

Critical · Active

11,102

CVSS ≥ 9.0

New · 14 days

3,221

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 12421–12450 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-43163	high	7.1/10	WordPress ParcelPanel plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43164	medium	6.5/10	WordPress Blockspare plugin <= 3.2.0 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-7590	medium	6.5/10	WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43210	medium	6.5/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.9.2 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43213	high	7.1/10	WordPress MultiVendorX Marketplace plugin <= 4.1.17 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43216	medium	6.5/10	WordPress Filr plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43217	high	7.1/10	WordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43218	medium	6.5/10	WordPress Mediavine Control Panel plugin <= 2.10.4 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43220	high	7.1/10	WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43224	medium	6.5/10	WordPress YaMaps for WordPress Plugin plugin <= 0.6.27 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43225	medium	6.5/10	WordPress Enter Addons plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43226	medium	6.5/10	WordPress WP Dashboard Notes plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43227	medium	6.5/10	WordPress BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43231	medium	6.5/10	WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43233	high	7.1/10	WordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-7548	high	8.8/10	LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter	Aug 8, 2024 1y ago
CVE-2024-5668	medium	6.4/10	Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes	Aug 8, 2024 1y ago
CVE-2024-41816	medium	5.4/10	WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode	Aug 5, 2024 1y ago
CVE-2024-38776	high	7.1/10	WordPress WP GoToWebinar plugin <= 15.7 - CSRF to XSS vulnerability	Aug 2, 2024 1y ago
CVE-2024-3238	high	8.8/10	WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion	Aug 2, 2024 1y ago
CVE-2024-39626	medium	5.9/10	WordPress Pretty Simple Popup Builder plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39627	medium	5.9/10	WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39629	medium	5.9/10	WordPress Himalayas theme <= 1.3.2 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39631	high	7.1/10	WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39643	medium	5.8/10	WordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39644	medium	6.5/10	WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39646	high	7.1/10	WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39647	high	7.1/10	WordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39648	medium	5.9/10	WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-39649	medium	6.5/10	WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago