Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,769

All time

Critical · Active

11,185

CVSS ≥ 9.0

New · 14 days

3,060

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 15091–15120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-31095	medium	4.7/10	WordPress Integration for Contact Form 7 HubSpot Plugin <= 1.2.8 is vulnerable to Open Redirection	Dec 29, 2023 2y ago
CVE-2023-28786	low	3.7/10	WordPress Solid Security Plugin <= 8.1.4 is vulnerable to Open Redirection	Dec 29, 2023 2y ago
CVE-2022-44589	high	8.1/10	WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure	Dec 29, 2023 2y ago
CVE-2023-51420	critical	9.1/10	WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-49830	critical	9.9/10	WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-47840	critical	9.9/10	WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-46623	critical	9.9/10	WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-45751	critical	9.1/10	WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-40606	critical	9.1/10	WordPress Kanban Boards for WordPress Plugin <= 2.5.21 is vulnerable to Arbitrary Code Execution	Dec 29, 2023 2y ago
CVE-2023-32095	critical	9.9/10	WordPress Rename Media Files Plugin <= 1.0.1 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-25054	critical	10.0/10	WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-22677	high	8.5/10	WordPress WP Booklet Plugin <= 2.1.8 is vulnerable to Remote Code Execution (RCE)	Dec 29, 2023 2y ago
CVE-2023-22676	low	3.1/10	WordPress Advanced Custom Fields: Image Crop Add-on Plugin <= 1.4.12 is vulnerable to Broken Access Control	Dec 29, 2023 2y ago
CVE-2022-36399	medium	5.3/10	WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data Exposure	Dec 28, 2023 2y ago
CVE-2023-50838	high	7.6/10	WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.5 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50839	critical	9.3/10	WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50840	high	8.5/10	WordPress Booking Manager Plugin <= 2.1.5 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50841	high	8.5/10	WordPress BookingPress Plugin <= 1.0.72 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50842	high	8.5/10	WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50843	high	7.6/10	WordPress Clockwork SMS Notfications Plugin <= 3.0.4 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50844	high	7.6/10	WordPress WP Mail Catcher Plugin <= 2.1.3 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50845	high	7.6/10	WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50846	high	7.6/10	WordPress RegistrationMagic Plugin <= 5.2.4.5 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50847	high	7.6/10	WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50848	high	7.6/10	WordPress 404 Solution Plugin <= 2.34.0 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50849	high	7.6/10	WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50852	high	7.6/10	WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50851	high	7.6/10	WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50853	high	7.6/10	WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-50854	high	7.6/10	WordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL Injection	Dec 28, 2023 2y ago