Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,009

All time

Critical · Active

12,560

CVSS ≥ 9.0

New · 14 days

1,499

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 13801–13830 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-33310	medium	6.0/10	WordPress Unite Gallery Lite plugin <= 1.7.59 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-32297	critical	9.0/10	WordPress LWS Affiliation plugin <= 2.2.6 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-32244	critical	9.8/10	WordPress Woodmart Core plugin <= 1.0.36 - Privilege Escalation	May 17, 2024 2y ago
CVE-2023-32129	medium	4.3/10	WordPress Editorialmag theme <= 1.1.9 - Authenticated Arbitrary Plugin Activation	May 17, 2024 2y ago
CVE-2023-32110	high	7.6/10	WordPress JupiterX theme <= 3.0.0 - Auth. Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-26540	critical	9.8/10	WordPress Houzez theme <= 2.7.1 - Privilege Escalation	May 17, 2024 2y ago
CVE-2023-26526	high	7.7/10	WordPress Bookly plugin <= 21.7.1 - Authenticated Arbitrary File Deletion vulnerability	May 17, 2024 2y ago
CVE-2023-26009	critical	9.8/10	WordPress Houzez Login Register plugin <= 2.6.3 - Privilege Escalation	May 17, 2024 2y ago
CVE-2023-25701	critical	9.8/10	WordPress WatchTowerHQ plugin <= 3.6.16 - Privilege Escalation	May 17, 2024 2y ago
CVE-2023-25444	critical	9.1/10	WordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerability	May 17, 2024 2y ago
CVE-2023-25050	high	7.1/10	WordPress Shortcodes Ultimate plugin <= 5.12.6 - Arbitrary File Download vulnerability	May 17, 2024 2y ago
CVE-2023-24379	medium	6.8/10	WordPress Landing Page Builder – Free Landing Page Templates plugin <= 3.1.9.9 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-23990	high	7.6/10	WordPress Redirection for Contact Form 7 plugin <= 2.7.0 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-23988	high	7.5/10	WordPress My Tickets plugin <= 1.9.11 - Payment Bypass Vulnerability	May 17, 2024 2y ago
CVE-2022-45374	high	7.7/10	WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.4 - Local File Inclusion	May 17, 2024 2y ago
CVE-2022-45368	high	7.7/10	WordPress 1003 Mortgage Application plugin <= 1.75 - Local File Inclusion	May 17, 2024 2y ago
CVE-2022-45070	medium	5.3/10	WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerability	May 17, 2024 2y ago
CVE-2022-44581	medium	5.0/10	WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability	May 17, 2024 2y ago
CVE-2024-31351	critical	10.0/10	WordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability	May 17, 2024 2y ago
CVE-2024-33556	high	8.2/10	WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability	May 17, 2024 2y ago
CVE-2024-32800	medium	6.5/10	WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34567	medium	6.5/10	WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34575	medium	6.5/10	WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34752	high	7.1/10	WordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-34757	medium	6.5/10	WordPress Borderless plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-4204	medium	4.3/10	Bulk Posts Editing For WordPress <= 4.2.3 - Cross-Site Request Forgery	May 16, 2024 2y ago
CVE-2024-34760	medium	5.9/10	WordPress Magazine Blocks plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability	May 16, 2024 2y ago
CVE-2024-34805	medium	6.5/10	WordPress iframe plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability	May 16, 2024 2y ago
CVE-2024-34751	medium	4.4/10	WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability	May 16, 2024 2y ago
CVE-2024-34808	medium	4.3/10	WordPress JCH Optimize plugin <= 4.2.0 - Path Traversal vulnerability	May 16, 2024 2y ago