Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,729

All time

Critical · Active

11,182

CVSS ≥ 9.0

New · 14 days

3,075

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 14731–14760 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-1468	high	8.8/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload	Feb 29, 2024 2y ago
CVE-2023-51692	medium	4.3/10	WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access Control	Feb 28, 2024 2y ago
CVE-2023-51533	medium	5.4/10	WordPress Ecwid Shopping Cart Plugin <= 6.12.4 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-27948	medium	5.4/10	WordPress Atahualpa Theme <= 3.7.24 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-51683	medium	5.4/10	WordPress Easy PayPal Buy Now Button Plugin <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-51681	medium	6.5/10	WordPress Duplicator Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-52223	medium	5.4/10	WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-52226	medium	4.3/10	WordPress Advanced Flamingo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability	Feb 28, 2024 2y ago
CVE-2024-21749	medium	5.4/10	WordPress 1 click disable all Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-23519	medium	4.3/10	WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24701	medium	4.3/10	WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24702	medium	4.3/10	WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24705	medium	5.4/10	WordPress Accessibility Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24708	medium	4.3/10	WordPress W3SPEEDSTER Plugin <= 7.19 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-25930	medium	4.3/10	WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-25931	medium	4.3/10	WordPress Heureka Plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-25932	medium	4.3/10	WordPress Change Table Prefix plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability	Feb 28, 2024 2y ago
CVE-2024-24868	high	8.5/10	WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-25902	high	7.6/10	WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-25910	critical	9.8/10	WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-25927	critical	9.3/10	WordPress postMash – custom post order Plugin <= 1.2.0 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-0975	medium	5.3/10	WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API	Feb 28, 2024 2y ago
CVE-2024-1436	medium	5.3/10	WordPress WooCommerce Coupon Popup, SmartBar, Slide In \| MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data Exposure	Feb 26, 2024 2y ago
CVE-2024-24714	high	7.2/10	WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25909	critical	9.9/10	WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25913	critical	10.0/10	WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25925	critical	10.0/10	WordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin <= 3.5.12 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25928	high	7.1/10	WordPress Sitepact's Contact Form 7 Extension For Klaviyo Plugin <= 1.0.5 is vulnerable to SQL Injection	Feb 23, 2024 2y ago
CVE-2024-25915	medium	4.9/10	WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF)	Feb 23, 2024 2y ago
CVE-2023-24416	medium	6.8/10	WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion	Feb 23, 2024 2y ago