Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,024

All time

Critical · Active

12,561

CVSS ≥ 9.0

New · 14 days

1,514

Newly disclosed

Feed last synced

26 mins ago

Data freshness

Showing 13831–13860 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-3750	high	8.8/10	Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution	May 16, 2024 2y ago
CVE-2024-4199	medium	4.3/10	Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization	May 15, 2024 2y ago
CVE-2024-0437	medium	4.3/10	Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure	May 14, 2024 2y ago
CVE-2023-33327	high	8.8/10	WordPress Leyka plugin <= 3.30.2 - Privilege Escalation vulnerability	May 14, 2024 2y ago
CVE-2024-35167	medium	6.5/10	WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <=1.4.8 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-35169	medium	5.9/10	WordPress All Bootstrap Blocks plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-35170	medium	5.9/10	WordPress Sticky banner plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-4747	high	7.1/10	WordPress Propovoice CRM plugin <= 1.7.6.2 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-32100	medium	5.3/10	WordPress Easy Digital Downloads plugin <= 3.2.11 - Sensitive Data Exposure vulnerability	May 13, 2024 2y ago
CVE-2024-34812	medium	5.3/10	WordPress ShopBuilder plugin <= 2.1.8 - Sensitive Data Exposure vulnerability	May 13, 2024 2y ago
CVE-2024-35165	medium	5.3/10	WordPress Gutenify plugin <= 1.4.0 - Sensitive Data Exposure via API vulnerability	May 13, 2024 2y ago
CVE-2024-35166	medium	5.3/10	WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 5.6.3 - Sensitive Data Exposure vulnerability	May 13, 2024 2y ago
CVE-2024-35171	medium	5.3/10	WordPress Academy LMS plugin <= 1.9.25 - Sensitive Data Exposure vulnerability	May 13, 2024 2y ago
CVE-2024-31377	critical	10.0/10	WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-34411	critical	9.9/10	WordPress canvasio3D Light plugin <= 2.5.0 - Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-34416	critical	9.1/10	WordPress Pk Favicon Manager plugin <= 2.1 - Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-34440	critical	9.1/10	WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-34555	critical	9.1/10	WordPress Z-Downloads plugin <= 1.11.3 - Auth. Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-35172	medium	4.4/10	WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability	May 13, 2024 2y ago
CVE-2024-34811	medium	5.9/10	WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-32700	critical	10.0/10	WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability	May 13, 2024 2y ago
CVE-2024-4560	critical	9.8/10	Kognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function	May 11, 2024 2y ago
CVE-2024-4630	medium	6.4/10	Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 11, 2024 2y ago
CVE-2024-4417	medium	4.4/10	Falang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 10, 2024 2y ago
CVE-2024-4277	medium	6.4/10	LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter	May 10, 2024 2y ago
CVE-2024-32776	medium	6.5/10	WordPress AppPresser plugin <= 4.3.0 - Broken Access Control vulnerability	May 10, 2024 2y ago
CVE-2024-34818	high	7.1/10	WordPress Webinar plugin <= 1.33.17 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34814	medium	5.4/10	WordPress Unyson plugin <=2.7.29 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34816	medium	5.4/10	WordPress WPCal.io plugin <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-34817	medium	4.3/10	WordPress Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago