Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,020

All time

Critical · Active

12,271

CVSS ≥ 9.0

New · 14 days

2,208

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 12481–12510 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-47319	high	8.0/10	WordPress Bit Form plugin <= 2.13.10 - Arbitrary File Upload vulnerability	Oct 5, 2024 1y ago
CVE-2024-47316	medium	4.3/10	WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability	Oct 5, 2024 1y ago
CVE-2024-47309	medium	6.6/10	WordPress Cities Shipping Zones for WooCommerce plugin <= 1.2.7 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44034	high	7.5/10	WordPress WPSPX plugin <= 1.0.2 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44023	high	8.1/10	WordPress ABCApp Creator plugin <= 1.1.2 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44018	high	7.5/10	WordPress Instant Chat WP plugin <= 1.0.5 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44016	high	7.5/10	WordPress Podiant plugin <= 1.1 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44015	high	7.5/10	WordPress Users Control plugin <= 1.0.16 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44014	critical	9.6/10	WordPress Vmax Project Manager plugin <= 1.0 - Local File Inclusion to RCE vulnerability	Oct 5, 2024 1y ago
CVE-2024-44013	high	7.5/10	WordPress VR Calendar plugin <= 2.4.0 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44012	high	7.5/10	WordPress WP Newsletter Subscription plugin <= 1.1 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-44011	high	7.5/10	WordPress WP Ticket Ultra plugin <= 1.0.5 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-9146	medium	4.9/10	WordPress CSS JS Files plugin <= 1.5.0 - Directory Traversal to File Read vulnerability	Oct 5, 2024 1y ago
CVE-2024-8743	medium	6.8/10	Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload	Oct 5, 2024 1y ago
CVE-2024-9375	medium	6.1/10	WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting	Oct 4, 2024 1y ago
CVE-2024-8505	medium	6.4/10	WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter	Oct 2, 2024 1y ago
CVE-2024-8282	medium	6.4/10	Ibtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Oct 2, 2024 1y ago
CVE-2024-44017	high	7.5/10	WordPress MH Board plugin <= 1.3.2.1 - Local File Inclusion vulnerability	Oct 2, 2024 1y ago
CVE-2024-44030	high	7.2/10	WordPress Checkout Mestres WP plugin <= 8.6 - Local File Inclusion vulnerability	Oct 2, 2024 1y ago
CVE-2024-8254	medium	5.4/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution	Oct 2, 2024 1y ago
CVE-2024-9289	critical	9.8/10	WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation	Oct 1, 2024 1y ago
CVE-2024-8288	medium	6.4/10	Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Oct 1, 2024 1y ago
CVE-2024-9267	medium	6.1/10	Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter	Oct 1, 2024 1y ago
CVE-2024-8632	medium	6.5/10	KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure	Oct 1, 2024 1y ago
CVE-2024-8548	high	8.1/10	KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions	Oct 1, 2024 1y ago
CVE-2024-47396	medium	6.5/10	WordPress Move Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2024 1y ago
CVE-2024-47641	medium	6.5/10	WordPress Confetti Fall Animation plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Sep 30, 2024 1y ago
CVE-2024-9049	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module	Sep 27, 2024 1y ago
CVE-2024-8771	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure	Sep 26, 2024 1y ago
CVE-2022-4541	high	7.2/10	WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header	Sep 26, 2024 1y ago