Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,041

All time

Critical · Active

11,140

CVSS ≥ 9.0

New · 14 days

2,673

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 13411–13440 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-25050	high	7.1/10	WordPress Shortcodes Ultimate plugin <= 5.12.6 - Arbitrary File Download vulnerability	May 17, 2024 2y ago
CVE-2023-24379	medium	6.8/10	WordPress Landing Page Builder – Free Landing Page Templates plugin <= 3.1.9.9 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-23990	high	7.6/10	WordPress Redirection for Contact Form 7 plugin <= 2.7.0 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-23988	high	7.5/10	WordPress My Tickets plugin <= 1.9.11 - Payment Bypass Vulnerability	May 17, 2024 2y ago
CVE-2022-45374	high	7.7/10	WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.4 - Local File Inclusion	May 17, 2024 2y ago
CVE-2022-45368	high	7.7/10	WordPress 1003 Mortgage Application plugin <= 1.75 - Local File Inclusion	May 17, 2024 2y ago
CVE-2022-45070	medium	5.3/10	WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerability	May 17, 2024 2y ago
CVE-2022-44581	medium	5.0/10	WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability	May 17, 2024 2y ago
CVE-2024-31351	critical	10.0/10	WordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability	May 17, 2024 2y ago
CVE-2024-33556	high	8.2/10	WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability	May 17, 2024 2y ago
CVE-2024-32800	medium	6.5/10	WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34567	medium	6.5/10	WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34575	medium	6.5/10	WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34752	high	7.1/10	WordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34757	medium	6.5/10	WordPress Borderless plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-4204	medium	4.3/10	Bulk Posts Editing For WordPress <= 4.2.3 - Cross-Site Request Forgery	May 16, 2024 2y ago
CVE-2024-34760	medium	5.9/10	WordPress Magazine Blocks plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability	May 16, 2024 2y ago
CVE-2024-34805	medium	6.5/10	WordPress iframe plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability	May 16, 2024 2y ago
CVE-2024-34751	medium	4.4/10	WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability	May 16, 2024 2y ago
CVE-2024-34808	medium	4.3/10	WordPress JCH Optimize plugin <= 4.2.0 - Path Traversal vulnerability	May 16, 2024 2y ago
CVE-2024-3750	high	8.8/10	Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution	May 16, 2024 2y ago
CVE-2024-4199	medium	4.3/10	Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization	May 15, 2024 2y ago
CVE-2024-0437	medium	4.3/10	Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure	May 14, 2024 2y ago
CVE-2023-33327	high	8.8/10	WordPress Leyka plugin <= 3.30.2 - Privilege Escalation vulnerability	May 14, 2024 2y ago
CVE-2024-35167	medium	6.5/10	WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <=1.4.8 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-35169	medium	5.9/10	WordPress All Bootstrap Blocks plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-35170	medium	5.9/10	WordPress Sticky banner plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-4747	high	7.1/10	WordPress Propovoice CRM plugin <= 1.7.6.2 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-32100	medium	5.3/10	WordPress Easy Digital Downloads plugin <= 3.2.11 - Sensitive Data Exposure vulnerability	May 13, 2024 2y ago
CVE-2024-34812	medium	5.3/10	WordPress ShopBuilder plugin <= 2.1.8 - Sensitive Data Exposure vulnerability	May 13, 2024 2y ago