Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,062

All time

Critical · Active

12,569

CVSS ≥ 9.0

New · 14 days

1,366

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 14011–14040 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-2346	medium	5.4/10	FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference	May 2, 2024 2y ago
CVE-2024-1809	medium	5.4/10	Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3649	medium	5.3/10	Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation	May 2, 2024 2y ago
CVE-2024-3942	medium	6.3/10	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization	May 2, 2024 2y ago
CVE-2024-3546	medium	4.3/10	WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal	May 2, 2024 2y ago
CVE-2024-3554	medium	6.4/10	All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 2, 2024 2y ago
CVE-2024-3107	medium	4.3/10	Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal	May 2, 2024 2y ago
CVE-2024-2345	medium	6.4/10	FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-33948	medium	5.5/10	WordPress TweetScroll Widget plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33949	medium	6.5/10	WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-4433	medium	5.9/10	WordPress Simple Image Popup plugin <= 2.4.0 - Cross-Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33950	medium	5.9/10	WordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33951	medium	6.5/10	WordPress Perfect Pullquotes plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33942	medium	4.3/10	WordPress Google Typography plugin <= 1.1.2 - Broken Access Control vulnerability	May 2, 2024 2y ago
CVE-2024-33944	medium	6.5/10	WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability	May 2, 2024 2y ago
CVE-2024-33956	medium	4.3/10	WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerability	May 2, 2024 2y ago
CVE-2024-33952	medium	6.5/10	WordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33953	medium	6.5/10	WordPress Adventure Journal theme <= 1.7.2 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33954	medium	6.5/10	WordPress Pliska theme <= 0.3.5 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33955	medium	6.5/10	WordPress Freesia Empire theme <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33938	medium	6.5/10	WordPress Sliding Widgets plugin <= 1.5.0 - Broken Access Control to XSS vulnerability	May 2, 2024 2y ago
CVE-2024-33911	high	7.6/10	WordPress The School Management Pro plugin <= 10.3.4 - SQL Injection vulnerability	May 2, 2024 2y ago
CVE-2024-33922	medium	5.3/10	WordPress WP Media Cleaner plugin <= 6.7.2 - Sensitive Data Exposure via Log File vulnerability	May 2, 2024 2y ago
CVE-2024-33930	medium	4.7/10	WordPress Share This Image plugin <= 1.97 - Open Redirection vulnerability	May 2, 2024 2y ago
CVE-2024-33913	critical	9.6/10	WordPress Xserver Migrator plugin <= 1.6.1 - CSRF to Arbitrary File Upload vulnerability	May 2, 2024 2y ago
CVE-2024-3591	—	—	WordPress Geo Controller < 8.6.5 - PHP Object Injection	May 1, 2024 2y ago
CVE-2024-33585	medium	4.3/10	WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerability	Apr 29, 2024 2y ago
CVE-2024-33586	medium	5.3/10	WordPress Photo Gallery by 10Web plugin <= 1.8.20 - Broken Access Control vulnerability	Apr 29, 2024 2y ago
CVE-2024-33587	medium	5.3/10	WordPress Secure Copy Content Protection and Content Locking plugin <= 3.9.0 - Broken Access Control vulnerability	Apr 29, 2024 2y ago
CVE-2024-33588	medium	5.4/10	WordPress basepress plugin <= 2.16.1 - Broken Access Control vulnerability	Apr 29, 2024 2y ago