Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,064

All time

Critical · Active

12,278

CVSS ≥ 9.0

New · 14 days

1,763

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15091–15120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-52226	medium	4.3/10	WordPress Advanced Flamingo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability	Feb 28, 2024 2y ago
CVE-2024-21749	medium	5.4/10	WordPress 1 click disable all Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-23519	medium	4.3/10	WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24701	medium	4.3/10	WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24702	medium	4.3/10	WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24705	medium	5.4/10	WordPress Accessibility Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24708	medium	4.3/10	WordPress W3SPEEDSTER Plugin <= 7.19 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-25930	medium	4.3/10	WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-25931	medium	4.3/10	WordPress Heureka Plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-25932	medium	4.3/10	WordPress Change Table Prefix plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability	Feb 28, 2024 2y ago
CVE-2024-24868	high	8.5/10	WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-25902	high	7.6/10	WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-25910	critical	9.8/10	WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-25927	critical	9.3/10	WordPress postMash – custom post order Plugin <= 1.2.0 is vulnerable to SQL Injection	Feb 28, 2024 2y ago
CVE-2024-0975	medium	5.3/10	WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API	Feb 28, 2024 2y ago
CVE-2024-1436	medium	5.3/10	WordPress WooCommerce Coupon Popup, SmartBar, Slide In \| MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data Exposure	Feb 26, 2024 2y ago
CVE-2024-24714	high	7.2/10	WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25909	critical	9.9/10	WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25913	critical	10.0/10	WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25925	critical	10.0/10	WordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin <= 3.5.12 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-25928	high	7.1/10	WordPress Sitepact's Contact Form 7 Extension For Klaviyo Plugin <= 1.0.5 is vulnerable to SQL Injection	Feb 23, 2024 2y ago
CVE-2024-25915	medium	4.9/10	WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF)	Feb 23, 2024 2y ago
CVE-2023-24416	medium	6.8/10	WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion	Feb 23, 2024 2y ago
CVE-2024-24798	medium	4.3/10	WordPress Debug Plugin <= 1.10 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24802	medium	4.3/10	WordPress JTRT Responsive Tables Plugin <= 4.1.9 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24837	medium	4.3/10	Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress plugins	Feb 21, 2024 2y ago
CVE-2024-24843	high	7.1/10	WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24849	medium	4.3/10	WordPress Quicksand Post Filter jQuery Plugin Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24872	medium	4.3/10	WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-24876	medium	4.3/10	WordPress Admin Menu Editor Plugin <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago