Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,003

All time

Critical · Active

12,560

CVSS ≥ 9.0

New · 14 days

1,493

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 13651–13680 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-34796	medium	5.9/10	WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-34797	medium	5.9/10	WordPress Simple Popup Manager plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-34801	medium	6.5/10	WordPress Praison SEO WordPress plugin <= 4.0.15 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35631	high	7.1/10	WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35630	high	7.6/10	WordPress WP TripAdvisor Review Slider plugin <= 12.6 - SQL Injection vulnerability	Jun 3, 2024 2y ago
CVE-2024-34754	medium	5.3/10	WordPress Contact Form Widget plugin <= 1.3.9 - Sensitive Data Exposure vulnerability	Jun 3, 2024 2y ago
CVE-2024-34798	medium	5.3/10	WordPress Debug Log – Manger Tool plugin <= 1.4.5 - Sensitive Data Exposure vulnerability	Jun 3, 2024 2y ago
CVE-2024-34803	medium	4.3/10	WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability	Jun 3, 2024 2y ago
CVE-2024-35633	medium	4.4/10	WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35635	medium	4.4/10	WordPress Ninja Tables plugin <= 5.0.9 - Server Side Request Forgery (SSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35637	medium	4.4/10	WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35638	medium	4.3/10	WordPress ActiveDEMAND plugin <= 0.2.43 - Cross Site Request Forgery (CSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35639	medium	5.9/10	WordPress Simple Spoiler plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35640	medium	5.9/10	WordPress Safety Exit plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35641	medium	5.9/10	WordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35642	medium	5.9/10	WordPress Site Favicon plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35643	medium	5.9/10	WordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-35645	medium	5.9/10	WordPress Random Banner plugin <= 4.2.12 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2024 2y ago
CVE-2024-35646	medium	5.9/10	WordPress Smartarget Message Bar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2024 2y ago
CVE-2024-35647	medium	5.9/10	WordPress Global Notification Bar plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2024 2y ago
CVE-2024-35636	medium	4.3/10	WordPress Uploadcare File Uploader and Adaptive Delivery plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability	Jun 1, 2024 2y ago
CVE-2024-4958	high	7.1/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation	Jun 1, 2024 2y ago
CVE-2024-4711	medium	6.4/10	WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting	Jun 1, 2024 2y ago
CVE-2024-5326	high	8.8/10	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update	May 30, 2024 2y ago
CVE-2024-5207	high	7.2/10	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection	May 30, 2024 2y ago
CVE-2024-5223	medium	6.4/10	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting	May 30, 2024 2y ago
CVE-2024-3412	critical	9.1/10	WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload	May 29, 2024 2y ago
CVE-2024-0434	medium	5.3/10	WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save	May 29, 2024 2y ago
CVE-2024-4045	medium	6.4/10	Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 25, 2024 2y ago
CVE-2024-4366	medium	6.4/10	Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting	May 24, 2024 2y ago