Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,117

All time

Critical · Active

12,574

CVSS ≥ 9.0

New · 14 days

1,414

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 14131–14160 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-51484	critical	9.8/10	WordPress Login as User or Customer plugin <= 3.8 - Unauthenticated Account Takeover vulnerability	Apr 25, 2024 2y ago
CVE-2023-51482	critical	9.9/10	WordPress Eazy Plugin Manager plugin <= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability	Apr 25, 2024 2y ago
CVE-2023-51478	critical	9.8/10	WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability	Apr 25, 2024 2y ago
CVE-2023-51477	critical	9.8/10	WordPress BuddyBoss Theme theme <= 2.4.60 - Unauth. Arbitrary WordPress Settings Change vulnerability	Apr 24, 2024 2y ago
CVE-2023-51472	critical	9.8/10	WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Account Takeover vulnerability	Apr 24, 2024 2y ago
CVE-2023-51471	high	8.2/10	WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerability	Apr 24, 2024 2y ago
CVE-2023-51425	critical	9.8/10	WordPress Rencontre plugin <= 3.10.1 - Unauthenticated Account Takeover vulnerability	Apr 24, 2024 2y ago
CVE-2023-51405	high	8.2/10	WordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerability	Apr 24, 2024 2y ago
CVE-2023-48763	medium	5.3/10	WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability	Apr 24, 2024 2y ago
CVE-2023-47774	medium	5.4/10	WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability	Apr 24, 2024 2y ago
CVE-2023-47504	medium	6.5/10	WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability	Apr 24, 2024 2y ago
CVE-2023-32127	medium	5.3/10	WordPress Multi Rating plugin <= 5.0.6 - Unauth Arbitrary rating value change	Apr 24, 2024 2y ago
CVE-2023-31090	critical	9.9/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability	Apr 24, 2024 2y ago
CVE-2023-25790	medium	5.3/10	WordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes Injection	Apr 24, 2024 2y ago
CVE-2024-32078	medium	4.1/10	WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability	Apr 24, 2024 2y ago
CVE-2024-32432	medium	4.3/10	WordPress Ovic Addon Toolkit plugin <= 2.6.1 - Broken Access Control vulnerability	Apr 24, 2024 2y ago
CVE-2024-32675	medium	6.5/10	WordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability	Apr 24, 2024 2y ago
CVE-2024-32677	medium	6.5/10	WordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerability	Apr 24, 2024 2y ago
CVE-2024-32678	medium	5.3/10	WordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerability	Apr 24, 2024 2y ago
CVE-2024-32699	medium	4.3/10	WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32728	medium	4.3/10	WordPress Paid Membership Subscriptions plugin <= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32773	medium	4.3/10	WordPress Royal Elementor Kit theme <= 1.0.116 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32793	medium	5.4/10	WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32794	medium	4.3/10	WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32795	medium	4.3/10	WordPress WPCal.io <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32806	medium	4.3/10	WordPress Headline Analyzer plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32947	medium	4.3/10	WordPress WP ADA Compliance Check Basic plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32958	high	7.1/10	WordPress Slash Admin plugin <= 3.8.1 - CSRF to XSS vulnerability	Apr 24, 2024 2y ago
CVE-2023-25785	medium	5.3/10	WordPress WP Post Rating plugin <= 2.5 - Vote Manipulation Vulnerability	Apr 24, 2024 2y ago
CVE-2023-23989	medium	5.3/10	WordPress RegistrationMagic plugin <= 5.1.9.2 - Content Injection	Apr 24, 2024 2y ago