Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,001

All time

Critical · Active

11,136

CVSS ≥ 9.0

New · 14 days

2,713

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 13291–13320 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-4566	high	7.1/10	ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification	May 21, 2024 2y ago
CVE-2024-4849	medium	6.4/10	WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter	May 18, 2024 2y ago
CVE-2024-35174	medium	5.3/10	WordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerability	May 17, 2024 2y ago
CVE-2024-34755	medium	4.3/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability	May 17, 2024 2y ago
CVE-2024-34756	medium	4.3/10	WordPress Integration for HubSpot and Contact Form 7 plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability	May 17, 2024 2y ago
CVE-2024-34806	medium	4.3/10	WordPress Clearfy Cache plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability	May 17, 2024 2y ago
CVE-2024-34807	medium	4.3/10	WordPress Fast Custom Social Share by CodeBard plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability	May 17, 2024 2y ago
CVE-2024-34809	medium	4.3/10	WordPress EmpowerWP theme <= 1.0.21 - Cross Site Request Forgery (CSRF) vulnerability	May 17, 2024 2y ago
CVE-2024-32960	high	8.8/10	WordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-32959	high	8.8/10	WordPress Sirv plugin <= 7.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-32830	high	8.6/10	WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability	May 17, 2024 2y ago
CVE-2024-32827	medium	5.3/10	WordPress Giveaways and Contests by RafflePress plugin <= 1.12.7 - IP Restriction Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-32809	critical	10.0/10	WordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerability	May 17, 2024 2y ago
CVE-2024-32802	medium	5.3/10	WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerability	May 17, 2024 2y ago
CVE-2024-32786	medium	5.3/10	WordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-32774	medium	4.3/10	WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-32720	medium	5.3/10	WordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-32708	low	3.7/10	WordPress Maintenance Mode plugin <= 3.0.1 - IP Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-32692	high	8.2/10	WordPress Chauffeur Taxi Booking System for WordPress plugin <= 6.9 - Broken Authentication vulnerability	May 17, 2024 2y ago
CVE-2024-32685	medium	5.3/10	WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerability	May 17, 2024 2y ago
CVE-2024-32680	high	8.8/10	WordPress HUSKY plugin <= 1.3.5.2 - Remote Code Execution (RCE) vulnerability	May 17, 2024 2y ago
CVE-2024-32523	high	8.1/10	WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2024-32521	medium	5.3/10	WordPress Zero Spam for WordPress plugin <= 5.5.6 - Bypass Spam Protection vulnerability	May 17, 2024 2y ago
CVE-2024-32512	medium	5.3/10	WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-32511	critical	9.8/10	WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-32507	high	8.8/10	WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-31300	high	8.5/10	WordPress Easy Social Share Buttons plugin <= 9.4 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2024-31290	critical	9.8/10	WordPress Demo My WordPress plugin <= 1.0.9.1 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-31281	medium	6.3/10	WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability	May 17, 2024 2y ago
CVE-2024-31237	high	7.5/10	WordPress s2Member plugin <= 240315 - Privilege Escalation vulnerability	May 17, 2024 2y ago