Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,008

All time

Critical · Active

12,560

CVSS ≥ 9.0

New · 14 days

1,498

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 13711–13740 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-32680	high	8.8/10	WordPress HUSKY plugin <= 1.3.5.2 - Remote Code Execution (RCE) vulnerability	May 17, 2024 2y ago
CVE-2024-32523	high	8.1/10	WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2024-32521	medium	5.3/10	WordPress Zero Spam for WordPress plugin <= 5.5.6 - Bypass Spam Protection vulnerability	May 17, 2024 2y ago
CVE-2024-32512	medium	5.3/10	WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-32511	critical	9.8/10	WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-32507	high	8.8/10	WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-31300	high	8.5/10	WordPress Easy Social Share Buttons plugin <= 9.4 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2024-31290	critical	9.8/10	WordPress Demo My WordPress plugin <= 1.0.9.1 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-31281	medium	6.3/10	WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability	May 17, 2024 2y ago
CVE-2024-31237	high	7.5/10	WordPress s2Member plugin <= 240315 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-31232	high	8.0/10	WordPress Rehub theme <= 19.6.1 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2024-31231	critical	9.0/10	WordPress Rehub theme <= 19.6.1 - Unauthenticated Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2024-30542	critical	9.8/10	WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-30509	medium	6.5/10	WordPress SellKit plugin <= 1.8.1 - Arbitrary File Download vulnerability	May 17, 2024 2y ago
CVE-2024-27971	high	8.3/10	WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2024-27955	high	8.8/10	WordPress Automatic plugin <= 3.92.0 - CSRF to Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-27954	critical	9.3/10	WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability	May 17, 2024 2y ago
CVE-2024-24934	high	8.5/10	WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability	May 17, 2024 2y ago
CVE-2024-24882	critical	9.8/10	WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-24869	high	7.5/10	WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerability	May 17, 2024 2y ago
CVE-2024-24715	medium	6.5/10	WordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerability	May 17, 2024 2y ago
CVE-2024-23522	medium	5.3/10	WordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerability	May 17, 2024 2y ago
CVE-2024-22157	critical	9.8/10	WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-22145	high	8.8/10	WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-22139	low	3.7/10	WordPress WordPress Manutenção plugin <= 1.0.6 - Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-21746	medium	5.3/10	WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-4214	low	2.7/10	WordPress cardealer plugin <= 4.15 - Content Injection vulnerability	May 17, 2024 2y ago
CVE-2023-51546	high	7.2/10	WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-51483	critical	9.8/10	WordPress WP Frontend Profile plugin <= 1.3.1 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-51481	critical	9.8/10	WordPress Local Delivery Drivers for WooCommerce plugin <= 1.9.0 - Unauthenticated Account Takeover vulnerability	May 17, 2024 2y ago