Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,739

All time

Critical · Active

11,182

CVSS ≥ 9.0

New · 14 days

3,053

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 14821–14850 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-0595	medium	4.3/10	Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()	Feb 10, 2024 2y ago
CVE-2024-0594	high	8.8/10	Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection	Feb 10, 2024 2y ago
CVE-2024-24834	medium	5.9/10	WordPress BEAR Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24836	medium	6.5/10	WordPress GDPR Data Request Form Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24871	medium	6.5/10	WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability	Feb 8, 2024 2y ago
CVE-2024-24877	high	7.1/10	WordPress Wonder Slider Lite Plugin <= 13.9 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24878	high	7.1/10	WordPress Portugal CTT Tracking for WooCommerce plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 8, 2024 2y ago
CVE-2024-24879	high	7.1/10	WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24880	medium	6.5/10	WordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24881	high	7.1/10	WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24885	medium	5.9/10	WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24886	medium	5.9/10	WordPress Product Labels For Woocommerce Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24706	medium	5.4/10	WordPress WP-CFM Plugin <= 1.7.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 7, 2024 2y ago
CVE-2023-7029	medium	6.4/10	WordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode	Feb 5, 2024 2y ago
CVE-2024-1177	medium	5.3/10	WP Club Manager – WordPress Sports Club Plugin <= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update	Feb 5, 2024 2y ago
CVE-2024-0790	medium	5.4/10	WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Cross-Site Request Forgery	Feb 5, 2024 2y ago
CVE-2023-6526	medium	6.4/10	Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 5, 2024 2y ago
CVE-2024-0791	medium	4.3/10	WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization	Feb 5, 2024 2y ago
CVE-2024-24838	medium	6.5/10	WordPress Five Star Restaurant Reviews Plugin <= 2.3.5 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24839	medium	6.5/10	WordPress Structured Content Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24841	medium	5.9/10	WordPress Add Customer for WooCommerce Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24846	high	7.1/10	WordPress Mighty Addons for Elementor Plugin <= 1.9.3 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24847	high	7.1/10	WordPress CalculatorPro Calculators Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24848	high	7.1/10	WordPress PT Sign Ups Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24865	medium	6.5/10	WordPress Scroll Triggered Box Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24866	high	7.1/10	WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2024-24870	medium	6.5/10	WordPress Advanced iFrame Plugin <= 2023.10 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2023-51504	medium	6.5/10	WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2023-51509	high	7.1/10	WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS)	Feb 1, 2024 2y ago
CVE-2023-51506	medium	5.5/10	WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)	Feb 1, 2024 2y ago