Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,031

All time

Critical · Active

12,563

CVSS ≥ 9.0

New · 14 days

1,511

Newly disclosed

Feed last synced

48 mins ago

Data freshness

Showing 13921–13950 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-34553	high	7.1/10	WordPress Stockholm Core plugin <= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34558	medium	5.9/10	WordPress WOLF plugin <= 1.0.8.2 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34560	medium	5.9/10	WordPress gee Search Plus plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34561	medium	5.9/10	WordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34562	medium	6.5/10	WordPress Move Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34563	medium	6.5/10	WordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34564	medium	6.5/10	WordPress Counter Up plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34565	medium	5.9/10	WordPress Debug Info plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34566	medium	6.5/10	WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34568	medium	5.9/10	WordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34569	medium	6.5/10	WordPress Zotpress plugin <= 7.3.9 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34570	medium	5.9/10	WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34571	medium	6.5/10	WordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34572	medium	6.5/10	WordPress Fancy Elementor Flipbox plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34573	medium	6.5/10	WordPress Pootle Pagebuilder plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34574	medium	5.9/10	WordPress Table Maker plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2023-41651	medium	6.5/10	WordPress Multi-column Tag Map plugin <= 17.0.26 - Broken Access Control vulnerability	May 8, 2024 2y ago
CVE-2023-31234	medium	6.3/10	WordPress Tilda Publishing plugin <= 0.3.23 - Broken Access Control vulnerability	May 7, 2024 2y ago
CVE-2024-34413	medium	5.9/10	WordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability	May 6, 2024 2y ago
CVE-2024-33570	medium	4.3/10	WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-33576	medium	6.5/10	WordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-33907	medium	5.3/10	WordPress Print My Blog plugin <= 3.26.2 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-33908	medium	5.3/10	WordPress WidgetKit plugin <= 2.5.0 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-33910	medium	5.3/10	WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-33912	high	7.1/10	WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability	May 6, 2024 2y ago
CVE-2024-34371	medium	4.3/10	WordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-34372	medium	5.3/10	WordPress Post Grid Master plugin <= 3.4.7 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-34377	medium	4.3/10	WordPress Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-34378	high	8.6/10	WordPress LeadConnector plugin <= 1.7 - API Broken Access Control vulnerability	May 6, 2024 2y ago
CVE-2024-34387	medium	4.3/10	WordPress WP Post Author plugin <= 3.6.4 - Rating Value Manipulation vulnerability	May 6, 2024 2y ago