Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,020

All time

Critical · Active

12,271

CVSS ≥ 9.0

New · 14 days

2,197

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 12751–12780 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-43344	medium	6.5/10	WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43346	medium	6.5/10	WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43347	medium	5.9/10	WordPress Button contact VR plugin <= 4.7.3 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43348	high	7.1/10	WordPress Purity Of Soul theme <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43349	medium	6.5/10	WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43351	medium	6.5/10	WordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43352	medium	6.5/10	WordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43353	medium	6.5/10	WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-7301	high	7.2/10	WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload	Aug 16, 2024 2y ago
CVE-2024-43165	medium	6.5/10	WordPress WPSection plugin <= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43160	critical	10.0/10	WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability	Aug 13, 2024 2y ago
CVE-2024-43153	critical	9.8/10	WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability	Aug 13, 2024 2y ago
CVE-2024-43141	critical	9.8/10	WordPress Participants Database plugin <= 2.5.9.2 - PHP Object Injection vulnerability	Aug 13, 2024 2y ago
CVE-2024-43140	high	7.5/10	WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43138	medium	6.5/10	WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43135	high	7.5/10	WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43131	high	7.5/10	WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43129	medium	6.5/10	WordPress BetterDocs plugin <= 3.5.8 - Local File Inclusion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43128	medium	6.5/10	WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerability	Aug 13, 2024 2y ago
CVE-2024-43121	critical	9.1/10	WordPress HUSKY plugin <= 1.3.6.1 - Privilege Escalation vulnerability	Aug 13, 2024 2y ago
CVE-2024-39651	high	8.6/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability	Aug 13, 2024 2y ago
CVE-2024-39642	medium	6.5/10	WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability	Aug 13, 2024 2y ago
CVE-2024-38787	high	7.5/10	WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability	Aug 13, 2024 2y ago
CVE-2024-38760	medium	5.3/10	WordPress Send Users Email plugin <= 1.5.1 - Sensitive Data Exposure vulnerability	Aug 13, 2024 2y ago
CVE-2024-38756	medium	5.3/10	WordPress Coming Soon Page – Responsive Coming Soon & Maintenance Mode plugin <= 1.6.3 - Sensitive Data Exposure vulnerability	Aug 13, 2024 2y ago
CVE-2024-38752	medium	6.5/10	WordPress Zoho Campaigns plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2024 2y ago
CVE-2024-38749	medium	5.3/10	WordPress Olive One Click Demo Import plugin <= 1.1.2 - Sensitive Data Exposure vulnerability	Aug 13, 2024 2y ago
CVE-2024-38747	high	7.5/10	WordPress HitPay Payment Gateway for WooCommerce plugin <= 4.1.3 - Sensitive Data Exposure via Log File vulnerability	Aug 13, 2024 2y ago
CVE-2024-38742	medium	5.3/10	WordPress MBE eShip plugin <= 2.1.2 - Sensitive Data Exposure vulnerability	Aug 13, 2024 2y ago
CVE-2024-38724	high	7.1/10	WordPress Contact Form 7 Summary and Print plugin <= 1.2.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability	Aug 13, 2024 2y ago