Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,733

All time

Critical · Active

11,182

CVSS ≥ 9.0

New · 14 days

3,065

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 14791–14820 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-25100	critical	10.0/10	WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability	Feb 12, 2024 2y ago
CVE-2023-47526	medium	5.9/10	WordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-50875	medium	6.5/10	WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-51370	medium	5.9/10	WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-51403	medium	6.5/10	WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24889	medium	6.1/10	WordPress All 404 Pages Redirect to Homepage Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24927	high	7.1/10	WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24928	medium	6.5/10	WordPress Content Cards Plugin <= 0.9.7 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24930	medium	6.5/10	WordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24931	medium	6.5/10	WordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24932	high	7.1/10	WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24933	high	7.1/10	WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-51404	medium	6.5/10	WordPress My Agile Privacy Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51415	medium	6.5/10	WordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51480	medium	6.5/10	WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51485	medium	6.5/10	WordPress Pay with Vipps for WooCommerce Plugin <= 1.14.13 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51488	high	7.1/10	WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51492	medium	6.5/10	WordPress If-So Dynamic Content Personalization Plugin <= 1.6.3.1 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51493	medium	6.5/10	WordPress Custom Post Carousels with Owl Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-23514	medium	6.5/10	WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-23516	medium	6.5/10	WordPress CC BMI Calculator Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-23517	medium	6.5/10	WordPress Scheduling Plugin – Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24712	medium	6.5/10	WordPress Heateor Social Login Plugin <= 1.1.30 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24713	medium	6.5/10	WordPress Auto Listings Plugin <= 2.6.5 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24717	medium	5.9/10	WordPress Beds24 Online Booking Plugin <= 2.0.23 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24801	medium	6.5/10	WordPress OWL Carousel Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24803	medium	6.5/10	WordPress Ultra Companion Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24804	medium	6.5/10	WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24831	medium	6.5/10	WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability	Feb 10, 2024 2y ago
CVE-2024-0596	medium	5.3/10	Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()	Feb 10, 2024 2y ago