Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,031

All time

Critical · Active

12,563

CVSS ≥ 9.0

New · 14 days

1,510

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 13981–14010 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-24710	medium	4.3/10	WordPress Feed Them Social plugin <= 4.2.0 - Broken Access Control vulnerability	May 3, 2024 2y ago
CVE-2024-32810	high	7.6/10	WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability	May 3, 2024 2y ago
CVE-2023-25457	medium	5.3/10	WordPress Slider Carousel – Responsive Image Slider plugin <=1.5.1 - Broken Access Control vulnerability	May 3, 2024 2y ago
CVE-2023-44472	medium	4.3/10	WordPress Unyson plugin <= 2.7.28 - Broken Access Control vulnerability	May 3, 2024 2y ago
CVE-2024-33941	medium	5.3/10	WordPress iPanorama 360 plugin <= 1.8.1 - Broken Access Control vulnerability	May 3, 2024 2y ago
CVE-2024-32831	medium	6.5/10	WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33916	medium	6.5/10	WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33918	medium	5.9/10	WordPress AJAX Login and Registration modal popup + inline form plugin <= 2.23 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33924	high	7.1/10	WordPress Realtyna Organic IDX plugin + WPL Real Estate plugin <= 4.14.4 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33926	medium	6.5/10	WordPress GWP-Histats plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33927	medium	6.5/10	WordPress Giphypress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33928	high	7.1/10	WordPress CodeBard's Patron Button and Widgets for Patreon plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33932	medium	6.5/10	WordPress Login Logout Register Menu plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33934	medium	6.5/10	WordPress Mini Loops plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33935	medium	6.5/10	WordPress PB MailCrypt plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33936	medium	6.5/10	WordPress Print-O-Matic plugin <= 2.1.10 - Auth. Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33940	medium	5.9/10	WordPress EventON plugin <= 2.2.14 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33943	medium	5.9/10	WordPress Ultimate Under Construction plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33945	medium	6.5/10	WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33946	high	7.1/10	WordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-33947	high	7.1/10	WordPress RegistrationMagic plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-3601	medium	5.3/10	Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration	May 2, 2024 2y ago
CVE-2024-3897	medium	5.3/10	Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure	May 2, 2024 2y ago
CVE-2024-1797	high	8.8/10	WP ULike – Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes	May 2, 2024 2y ago
CVE-2024-2417	high	8.8/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	May 2, 2024 2y ago
CVE-2024-3233	medium	4.3/10	Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation	May 2, 2024 2y ago
CVE-2024-4000	medium	6.4/10	WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 2, 2024 2y ago
CVE-2024-3287	medium	5.3/10	SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3295	medium	6.5/10	User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion	May 2, 2024 2y ago
CVE-2024-2967	medium	4.4/10	Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting	May 2, 2024 2y ago