Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,223

All time

Critical · Active

12,586

CVSS ≥ 9.0

New · 14 days

1,254

Newly disclosed

Feed last synced

44 mins ago

Data freshness

Showing 15061–15090 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-51474	high	8.8/10	WordPress TerraClassifieds plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability	Mar 16, 2024 2y ago
CVE-2023-51486	medium	5.4/10	WordPress WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.101 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51487	medium	5.4/10	WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51489	medium	5.4/10	WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51491	medium	5.4/10	WordPress Depicter Slider plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51510	medium	4.3/10	WordPress Export Media URLs plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51512	medium	4.3/10	WordPress Product Table by WBW plugin <= 1.8.6 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51521	medium	5.4/10	WordPress Quiz And Survey Master plugin <= 8.1.18 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51407	medium	4.3/10	WordPress Split Test For Elementor plugin <= 1.6.9 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2023-51522	medium	4.3/10	WordPress Paid Membership Subscriptions plugin <= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability	Mar 15, 2024 2y ago
CVE-2023-51369	medium	4.3/10	WordPress Customize My Account for WooCommerce plugin <= 1.8.3 - Cross Site Request Forgery (CSRF) vulnerability	Mar 15, 2024 2y ago
CVE-2023-50898	medium	5.4/10	WordPress Image Optimizer, Resizer and CDN – Sirv plugin <= 7.1.2 - Broken Access Control vulnerability	Mar 15, 2024 2y ago
CVE-2023-50886	medium	4.3/10	WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerability	Mar 15, 2024 2y ago
CVE-2023-51525	medium	4.3/10	WordPress WP Simple Booking Calendar plugin <= 2.0.8.4 - Cross Site Request Forgery (CSRF) vulnerability	Mar 15, 2024 2y ago
CVE-2023-50861	medium	4.3/10	WordPress HUSKY plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25597	high	7.1/10	WordPress Ultimate Reviews plugin <= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25596	medium	5.9/10	WordPress Doofinder for WooCommerce plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25593	medium	6.5/10	WordPress NEX-Forms plugin <= 8.5.5 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25592	medium	5.9/10	WordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25598	medium	6.5/10	WordPress Elementor Addons by Livemesh plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25916	medium	6.5/10	WordPress My Calendar plugin <= 3.4.23 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25919	medium	6.5/10	WordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25921	high	7.1/10	WordPress Action Network plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25934	medium	6.5/10	WordPress FormFacade plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-25936	medium	6.5/10	WordPress SoundCloud Shortcode plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-27189	medium	6.5/10	WordPress WP Social Widget plugin <= 2.2.5 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-27193	high	7.1/10	WordPress PayU India plugin <= 3.8.8 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-27196	high	7.1/10	WordPress postMash – custom post order plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-27192	high	7.1/10	WordPress Configure SMTP Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)	Mar 15, 2024 2y ago
CVE-2024-27987	high	7.1/10	WordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago