Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,743

All time

Critical · Active

11,182

CVSS ≥ 9.0

New · 14 days

3,050

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 14911–14940 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-22290	high	7.1/10	WordPress Custom Dashboard Widgets Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 31, 2024 2y ago
CVE-2024-23507	high	8.5/10	WordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerability	Jan 31, 2024 2y ago
CVE-2024-22305	high	7.5/10	WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)	Jan 31, 2024 2y ago
CVE-2024-0836	medium	4.3/10	WordPress Review & Structure Data Schema Plugin – Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review Update	Jan 31, 2024 2y ago
CVE-2023-6390	—	—	WordPress Users <= 1.4 - Settings Update via CSRF	Jan 29, 2024 2y ago
CVE-2023-6946	—	—	Autotitle for WordPress <= 1.0.3 - Settings Update to Stored XSS via CSRF	Jan 29, 2024 2y ago
CVE-2023-7204	—	—	WP STAGING WordPress Backup Plugin < 3.2.0 - Unauthorized Sensitive Data Exposure	Jan 29, 2024 2y ago
CVE-2023-6389	—	—	WordPress Toolbar <= 2.2.6 - Open Redirect	Jan 29, 2024 2y ago
CVE-2024-0212	high	8.1/10	Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)	Jan 29, 2024 2y ago
CVE-2023-6497	medium	4.4/10	WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting	Jan 27, 2024 2y ago
CVE-2024-23506	high	7.7/10	WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability	Jan 26, 2024 2y ago
CVE-2024-22147	high	7.6/10	WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL Injection	Jan 26, 2024 2y ago
CVE-2024-22283	high	8.5/10	WordPress Delhivery Logistics Courier Plugin <= 1.0.107 is vulnerable to SQL Injection	Jan 26, 2024 2y ago
CVE-2023-52187	medium	5.3/10	WordPress Image Source Control Plugin <= 2.17.0 is vulnerable to Sensitive Data Exposure	Jan 26, 2024 2y ago
CVE-2024-22141	medium	6.5/10	WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22154	high	7.5/10	WordPress SalesKing Plugin <= 1.6.15 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22294	medium	5.3/10	WordPress Download IP2Location Country Blocker Plugin <= 2.33.3 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22301	medium	5.3/10	WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22308	low	3.4/10	WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection	Jan 24, 2024 2y ago
CVE-2023-52221	critical	10.0/10	WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.1 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22135	high	8.0/10	WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22152	high	8.0/10	WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22284	high	8.7/10	WordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object Injection	Jan 24, 2024 2y ago
CVE-2024-22309	high	8.7/10	WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection	Jan 24, 2024 2y ago
CVE-2024-22134	medium	4.9/10	WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF)	Jan 24, 2024 2y ago
CVE-2022-47160	medium	6.5/10	WordPress Wp Social Plugin <= 1.9.0 is vulnerable to Sensitive Data Exposure	Jan 19, 2024 2y ago
CVE-2022-45845	medium	4.3/10	WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection	Jan 19, 2024 2y ago
CVE-2022-45083	medium	6.6/10	WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection	Jan 19, 2024 2y ago
CVE-2022-40700	high	8.2/10	Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins	Jan 19, 2024 2y ago
CVE-2022-42884	medium	5.4/10	WordPress WIP Custom Login Plugin <= 1.2.7 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago