Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

341,899

All time

Critical · Active

11,133

CVSS ≥ 9.0

New · 14 days

3,245

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 13171–13200 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-35664	high	7.1/10	WordPress WPvivid Backup for MainWP plugin <= 0.9.32 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-35666	medium	6.5/10	WordPress Themesflat Addons For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-35668	high	7.1/10	WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Brevo plugin <= 3.1.77 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-35782	medium	6.5/10	WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-35700	critical	9.8/10	WordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerability	Jun 4, 2024 2y ago
CVE-2024-35629	critical	9.6/10	WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-34792	critical	9.1/10	WordPress Dextaz Ping plugin <= 0.65 - Remote Code Execution (RCE) vulnerability	Jun 4, 2024 2y ago
CVE-2024-34554	high	8.5/10	WordPress Stockholm Core plugin <= 2.4.1 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-34552	high	8.5/10	WordPress Stockholm theme <= 9.6 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-34551	critical	9.0/10	WordPress Stockholm theme <= 9.6 - Unauthenticated Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-34384	medium	6.5/10	WordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-33628	high	8.8/10	WordPress XforWooCommerce plugin <= 2.0.2 - Authenticated Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-33568	high	8.5/10	WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability	Jun 4, 2024 2y ago
CVE-2024-33560	critical	9.0/10	WordPress XStore theme <= 9.3.8 - Unauthenticated Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-33557	high	8.5/10	WordPress XStore Core plugin <= 5.3.8 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-33541	medium	6.5/10	WordPress Better Elementor Addons plugin <= 1.4.1 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-25600	critical	10.0/10	WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability	Jun 4, 2024 2y ago
CVE-2023-52176	medium	5.3/10	WordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerability	Jun 4, 2024 2y ago
CVE-2023-52147	low	3.7/10	WordPress All-In-One Security (AIOS) plugin <= 5.2.4 - Secret Login Page Location Disclosure on Multisites vulnerability	Jun 4, 2024 2y ago
CVE-2023-51667	medium	5.3/10	WordPress Rate my Post – WP Rating System plugin <= 3.4.2 - Broken Access Control vulnerability	Jun 4, 2024 2y ago
CVE-2023-51544	medium	5.3/10	WordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerability	Jun 4, 2024 2y ago
CVE-2023-51543	medium	5.3/10	WordPress RegistrationMagic plugin <= 5.2.5.0 - IP Limit Bypass vulnerability	Jun 4, 2024 2y ago
CVE-2023-51542	medium	5.3/10	WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerability	Jun 4, 2024 2y ago
CVE-2023-51511	medium	6.5/10	WordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification Vulnerability	Jun 4, 2024 2y ago
CVE-2023-49852	medium	6.5/10	WordPress Responsive Slick Slider WordPress plugin <= 1.4 - Content Injection vulnerability	Jun 4, 2024 2y ago
CVE-2023-49822	low	3.7/10	WordPress Ultimate Dashboard plugin <= 3.7.10 - Secret Login Page Location Disclosure on Multisites vulnerability	Jun 4, 2024 2y ago
CVE-2023-49774	medium	5.3/10	WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability	Jun 4, 2024 2y ago
CVE-2023-49748	low	3.7/10	WordPress WPS Hide Login plugin <= 1.9.11 - Secret Login Page Location Disclosure on Multisites vulnerability	Jun 4, 2024 2y ago
CVE-2023-49741	low	3.7/10	WordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerability	Jun 4, 2024 2y ago
CVE-2023-48753	medium	5.3/10	WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability	Jun 4, 2024 2y ago