Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,020

All time

Critical · Active

12,271

CVSS ≥ 9.0

New · 14 days

2,197

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 12811–12840 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-43218	medium	6.5/10	WordPress Mediavine Control Panel plugin <= 2.10.4 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43220	high	7.1/10	WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43224	medium	6.5/10	WordPress YaMaps for WordPress Plugin plugin <= 0.6.27 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43225	medium	6.5/10	WordPress Enter Addons plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43226	medium	6.5/10	WordPress WP Dashboard Notes plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43227	medium	6.5/10	WordPress BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43231	medium	6.5/10	WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43233	high	7.1/10	WordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-7548	high	8.8/10	LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter	Aug 8, 2024 2y ago
CVE-2024-5668	medium	6.4/10	Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes	Aug 8, 2024 2y ago
CVE-2024-41816	medium	5.4/10	WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode	Aug 5, 2024 2y ago
CVE-2024-38776	high	7.1/10	WordPress WP GoToWebinar plugin <= 15.7 - CSRF to XSS vulnerability	Aug 2, 2024 2y ago
CVE-2024-3238	high	8.8/10	WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion	Aug 2, 2024 2y ago
CVE-2024-39626	medium	5.9/10	WordPress Pretty Simple Popup Builder plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39627	medium	5.9/10	WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39629	medium	5.9/10	WordPress Himalayas theme <= 1.3.2 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39631	high	7.1/10	WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39643	medium	5.8/10	WordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39644	medium	6.5/10	WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39646	high	7.1/10	WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39647	high	7.1/10	WordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39648	medium	5.9/10	WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39649	medium	6.5/10	WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39652	high	7.1/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39655	medium	6.5/10	WordPress LiquidPoll plugin <= 3.3.77 - Unauthenticated Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39656	high	7.1/10	WordPress Tin Canny Reporting for LearnDash plugin <= 4.3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39659	medium	6.5/10	WordPress WP-PostRatings plugin <= 1.91.1 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39660	medium	5.9/10	WordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.3.1 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39661	medium	6.5/10	WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-39662	medium	6.5/10	WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago