Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,048

All time

Critical · Active

11,141

CVSS ≥ 9.0

New · 14 days

2,667

Newly disclosed

Feed last synced

55 mins ago

Data freshness

Showing 13591–13620 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-33928	high	7.1/10	WordPress CodeBard's Patron Button and Widgets for Patreon plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33932	medium	6.5/10	WordPress Login Logout Register Menu plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33934	medium	6.5/10	WordPress Mini Loops plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33935	medium	6.5/10	WordPress PB MailCrypt plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33936	medium	6.5/10	WordPress Print-O-Matic plugin <= 2.1.10 - Auth. Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33940	medium	5.9/10	WordPress EventON plugin <= 2.2.14 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33943	medium	5.9/10	WordPress Ultimate Under Construction plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33945	medium	6.5/10	WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33946	high	7.1/10	WordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33947	high	7.1/10	WordPress RegistrationMagic plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-3601	medium	5.3/10	Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration	May 2, 2024 2y ago
CVE-2024-3897	medium	5.3/10	Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure	May 2, 2024 2y ago
CVE-2024-1797	high	8.8/10	WP ULike – Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes	May 2, 2024 2y ago
CVE-2024-2417	high	8.8/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	May 2, 2024 2y ago
CVE-2024-3233	medium	4.3/10	Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation	May 2, 2024 2y ago
CVE-2024-4000	medium	6.4/10	WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 2, 2024 2y ago
CVE-2024-3287	medium	5.3/10	SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3295	medium	6.5/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion	May 2, 2024 2y ago
CVE-2024-2967	medium	4.4/10	Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-2346	medium	5.4/10	FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference	May 2, 2024 2y ago
CVE-2024-1809	medium	5.4/10	Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3649	medium	5.3/10	Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation	May 2, 2024 2y ago
CVE-2024-3942	medium	6.3/10	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3546	medium	4.3/10	WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal	May 2, 2024 2y ago
CVE-2024-3554	medium	6.4/10	All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 2, 2024 2y ago
CVE-2024-3107	medium	4.3/10	Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal	May 2, 2024 2y ago
CVE-2024-2345	medium	6.4/10	FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-33948	medium	5.5/10	WordPress TweetScroll Widget plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33949	medium	6.5/10	WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-4433	medium	5.9/10	WordPress Simple Image Popup plugin <= 2.4.0 - Cross-Site Scripting (XSS) vulnerability	May 2, 2024 2y ago