Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,035

All time

Critical · Active

12,276

CVSS ≥ 9.0

New · 14 days

2,161

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 13801–13830 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-34411	critical	9.9/10	WordPress canvasio3D Light plugin <= 2.5.0 - Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-34416	critical	9.1/10	WordPress Pk Favicon Manager plugin <= 2.1 - Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-34440	critical	9.1/10	WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-34555	critical	9.1/10	WordPress Z-Downloads plugin <= 1.11.3 - Auth. Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-35172	medium	4.4/10	WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability	May 13, 2024 2y ago
CVE-2024-34811	medium	5.9/10	WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-32700	critical	10.0/10	WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-4560	critical	9.8/10	Kognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function	May 11, 2024 2y ago
CVE-2024-4630	medium	6.4/10	Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 11, 2024 2y ago
CVE-2024-4417	medium	4.4/10	Falang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 10, 2024 2y ago
CVE-2024-4277	medium	6.4/10	LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter	May 10, 2024 2y ago
CVE-2024-32776	medium	6.5/10	WordPress AppPresser plugin <= 4.3.0 - Broken Access Control vulnerability	May 10, 2024 2y ago
CVE-2024-34818	high	7.1/10	WordPress Webinar plugin <= 1.33.17 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34814	medium	5.4/10	WordPress Unyson plugin <=2.7.29 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34816	medium	5.4/10	WordPress WPCal.io plugin <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34817	medium	4.3/10	WordPress Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-31113	medium	4.3/10	WordPress Easy Digital Downloads plugin <= 3.2.11 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-4444	medium	5.3/10	LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration	May 10, 2024 2y ago
CVE-2024-4434	critical	9.8/10	LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection	May 10, 2024 2y ago
CVE-2024-4689	medium	4.3/10	WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34823	medium	4.3/10	WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.3 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34825	medium	4.3/10	WordPress Social Warfare plugin <= 4.4.5.1 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34827	medium	4.3/10	WordPress Translate Multilingual sites – TranslatePress plugin <= 2.7.5 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34828	medium	4.3/10	WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-4398	medium	6.4/10	HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 10, 2024 2y ago
CVE-2024-4397	high	8.8/10	LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload	May 9, 2024 2y ago
CVE-2024-1467	medium	4.3/10	Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery	May 9, 2024 2y ago
CVE-2024-4082	medium	4.3/10	Joli FAQ SEO – WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery	May 9, 2024 2y ago
CVE-2024-3923	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 9, 2024 2y ago
CVE-2024-4312	medium	4.3/10	Soccer Engine – Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery	May 9, 2024 2y ago