Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,063

All time

Critical · Active

12,278

CVSS ≥ 9.0

New · 14 days

1,798

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 14971–15000 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-29118	medium	6.5/10	WordPress Scrollsequence plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29121	high	7.1/10	WordPress WooCommerce License Manager plugin <= 5.3.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29122	medium	6.5/10	WordPress FV Player plugin <= 7.5.41.7212 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29123	high	7.1/10	WordPress Link Library plugin <= 7.6 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29124	medium	5.9/10	WordPress Advanced Access Manager plugin <= 6.9.20 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29125	high	7.1/10	WordPress Coupon Affiliates plugin <= 5.12.7 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29126	high	7.1/10	WordPress Specific Content For Mobile plugin <= 0.1.9.5 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29127	high	7.1/10	WordPress Advanced Access Manager plugin <= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29128	high	7.1/10	WordPress POST SMTP Mailer plugin <= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29129	high	7.1/10	WordPress OxyExtras plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29130	high	7.1/10	WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29134	medium	6.5/10	WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29135	critical	9.9/10	WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability	Mar 19, 2024 2y ago
CVE-2024-29136	high	8.5/10	WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability	Mar 19, 2024 2y ago
CVE-2024-29137	high	7.1/10	WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29138	high	7.1/10	WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29139	high	7.1/10	WordPress MyCurator Content Curation plugin <= 3.76 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29140	medium	5.9/10	WordPress MJM Clinic plugin <= 1.1.22 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29141	medium	5.5/10	WordPress PDF Embedder plugin <= 4.6.4 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29142	high	7.1/10	WordPress Better Search plugin <= 3.3.0 - Stored Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-29143	medium	6.5/10	WordPress Passwordless Login plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability	Mar 19, 2024 2y ago
CVE-2024-0820	—	—	Jobs for WordPress < 2.7.4 - Contributor+ Stored XSS	Mar 18, 2024 2y ago
CVE-2024-27961	high	7.1/10	WordPress AntiSpam for Contact Form 7 plugin <= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 17, 2024 2y ago
CVE-2024-27960	high	7.1/10	WordPress Email Subscription Popup plugin <= 1.2.20 - Cross Site Scripting (XSS) vulnerability	Mar 17, 2024 2y ago
CVE-2024-27959	high	7.1/10	WordPress APIExperts Square for WooCommerce plugin <= 4.2.9 - Cross Site Scripting (XSS) vulnerability	Mar 17, 2024 2y ago
CVE-2024-27958	high	7.1/10	WordPress Visualizer plugin <= 3.10.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 17, 2024 2y ago
CVE-2024-27957	critical	10.0/10	WordPress Pie Register plugin <= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability	Mar 17, 2024 2y ago
CVE-2024-25903	medium	5.3/10	WordPress Frontend File Manager Plugin plugin <= 22.7 - Sensitive Data Exposure vulnerability	Mar 17, 2024 2y ago
CVE-2024-25591	medium	5.3/10	WordPress WP Editor plugin <=1.2.7 - Sensitive Data Exposure vulnerability	Mar 17, 2024 2y ago
CVE-2024-24867	medium	5.3/10	WordPress WP Stats Manager plugin <= 6.9.4 - Sensitive Data Exposure vulnerability	Mar 17, 2024 2y ago