Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,039

All time

Critical · Active

12,276

CVSS ≥ 9.0

New · 14 days

2,157

Newly disclosed

Feed last synced

51 mins ago

Data freshness

Showing 13951–13980 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-33936	medium	6.5/10	WordPress Print-O-Matic plugin <= 2.1.10 - Auth. Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33940	medium	5.9/10	WordPress EventON plugin <= 2.2.14 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33943	medium	5.9/10	WordPress Ultimate Under Construction plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33945	medium	6.5/10	WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33946	high	7.1/10	WordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33947	high	7.1/10	WordPress RegistrationMagic plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-3601	medium	5.3/10	Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration	May 2, 2024 2y ago
CVE-2024-3897	medium	5.3/10	Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure	May 2, 2024 2y ago
CVE-2024-1797	high	8.8/10	WP ULike – Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes	May 2, 2024 2y ago
CVE-2024-2417	high	8.8/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	May 2, 2024 2y ago
CVE-2024-3233	medium	4.3/10	Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation	May 2, 2024 2y ago
CVE-2024-4000	medium	6.4/10	WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 2, 2024 2y ago
CVE-2024-3287	medium	5.3/10	SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3295	medium	6.5/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion	May 2, 2024 2y ago
CVE-2024-2967	medium	4.4/10	Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-2346	medium	5.4/10	FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference	May 2, 2024 2y ago
CVE-2024-1809	medium	5.4/10	Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3649	medium	5.3/10	Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation	May 2, 2024 2y ago
CVE-2024-3942	medium	6.3/10	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3546	medium	4.3/10	WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal	May 2, 2024 2y ago
CVE-2024-3554	medium	6.4/10	All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 2, 2024 2y ago
CVE-2024-3107	medium	4.3/10	Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal	May 2, 2024 2y ago
CVE-2024-2345	medium	6.4/10	FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-33948	medium	5.5/10	WordPress TweetScroll Widget plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33949	medium	6.5/10	WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-4433	medium	5.9/10	WordPress Simple Image Popup plugin <= 2.4.0 - Cross-Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33950	medium	5.9/10	WordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33951	medium	6.5/10	WordPress Perfect Pullquotes plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33942	medium	4.3/10	WordPress Google Typography plugin <= 1.1.2 - Broken Access Control vulnerability	May 2, 2024 2y ago
CVE-2024-33944	medium	6.5/10	WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability	May 2, 2024 2y ago