Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,001

All time

Critical · Active

11,136

CVSS ≥ 9.0

New · 14 days

2,748

Newly disclosed

Feed last synced

43 mins ago

Data freshness

Showing 13261–13290 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-35637	medium	4.4/10	WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35638	medium	4.3/10	WordPress ActiveDEMAND plugin <= 0.2.43 - Cross Site Request Forgery (CSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35639	medium	5.9/10	WordPress Simple Spoiler plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35640	medium	5.9/10	WordPress Safety Exit plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35641	medium	5.9/10	WordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35642	medium	5.9/10	WordPress Site Favicon plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35643	medium	5.9/10	WordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35645	medium	5.9/10	WordPress Random Banner plugin <= 4.2.12 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2024 2y ago
CVE-2024-35646	medium	5.9/10	WordPress Smartarget Message Bar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2024 2y ago
CVE-2024-35647	medium	5.9/10	WordPress Global Notification Bar plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2024 2y ago
CVE-2024-35636	medium	4.3/10	WordPress Uploadcare File Uploader and Adaptive Delivery plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability	Jun 1, 2024 2y ago
CVE-2024-4958	high	7.1/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation	Jun 1, 2024 2y ago
CVE-2024-4711	medium	6.4/10	WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting	Jun 1, 2024 2y ago
CVE-2024-5326	high	8.8/10	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update	May 30, 2024 2y ago
CVE-2024-5207	high	7.2/10	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection	May 30, 2024 2y ago
CVE-2024-5223	medium	6.4/10	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting	May 30, 2024 2y ago
CVE-2024-3412	critical	9.1/10	WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload	May 29, 2024 2y ago
CVE-2024-0434	medium	5.3/10	WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save	May 29, 2024 2y ago
CVE-2024-4045	medium	6.4/10	Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 25, 2024 2y ago
CVE-2024-4366	medium	6.4/10	Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-1814	medium	6.4/10	Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block	May 23, 2024 2y ago
CVE-2024-1815	medium	6.4/10	Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block	May 23, 2024 2y ago
CVE-2024-4706	medium	6.4/10	WordPress + Microsoft Office 365 / Azure AD \| LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode	May 23, 2024 2y ago
CVE-2024-3626	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization	May 23, 2024 2y ago
CVE-2024-4895	medium	4.7/10	wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import	May 23, 2024 2y ago
CVE-2024-4443	critical	9.8/10	Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter	May 22, 2024 2y ago
CVE-2024-3611	medium	6.4/10	Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 22, 2024 2y ago
CVE-2024-4971	medium	6.4/10	LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	May 22, 2024 2y ago
CVE-2024-3268	medium	5.3/10	YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation	May 21, 2024 2y ago
CVE-2024-4700	medium	6.4/10	WP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 21, 2024 2y ago