Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,733

All time

Critical · Active

11,182

CVSS ≥ 9.0

New · 14 days

3,067

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 14761–14790 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-24798	medium	4.3/10	WordPress Debug Plugin <= 1.10 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24802	medium	4.3/10	WordPress JTRT Responsive Tables Plugin <= 4.1.9 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24837	medium	4.3/10	Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress plugins	Feb 21, 2024 2y ago
CVE-2024-24843	high	7.1/10	WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24849	medium	4.3/10	WordPress Quicksand Post Filter jQuery Plugin Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24872	medium	4.3/10	WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24876	medium	4.3/10	WordPress Admin Menu Editor Plugin <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-25904	medium	4.3/10	WordPress TinyMCE Professional Formats and Styles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-1081	medium	6.4/10	3D FlipBook – PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks	Feb 21, 2024 2y ago
CVE-2024-25905	medium	5.4/10	WordPress Multi Step Form Plugin <= 1.7.18 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-1218	medium	4.3/10	Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization	Feb 20, 2024 2y ago
CVE-2024-0604	medium	4.4/10	Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings	Feb 20, 2024 2y ago
CVE-2024-1217	high	7.6/10	Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation	Feb 20, 2024 2y ago
CVE-2024-1512	critical	9.8/10	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection	Feb 17, 2024 2y ago
CVE-2024-25914	medium	4.3/10	WordPress SMTP Mail Plugin <= 1.3.20 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 13, 2024 2y ago
CVE-2023-6081	—	—	Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting in New Chart	Feb 12, 2024 2y ago
CVE-2023-6082	—	—	Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting	Feb 12, 2024 2y ago
CVE-2024-0420	—	—	MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS	Feb 12, 2024 2y ago
CVE-2024-0421	—	—	MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure	Feb 12, 2024 2y ago
CVE-2024-24875	medium	4.3/10	WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24884	medium	4.3/10	WordPress Contact Form 7 Connector Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24887	medium	5.4/10	WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24929	medium	4.3/10	WordPress WP Contact Form Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24935	medium	4.3/10	WordPress Basic Log Viewer Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2023-46615	medium	5.4/10	WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-23512	high	8.7/10	WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-23513	high	8.7/10	WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24796	high	8.2/10	WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24797	critical	9.8/10	WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24926	high	7.5/10	WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago