Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,237

All time

Critical · Active

12,586

CVSS ≥ 9.0

New · 14 days

1,265

Newly disclosed

Feed last synced

25 mins ago

Data freshness

Showing 15121–15150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-25594	medium	6.5/10	WordPress MyWaze Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2024-25098	medium	6.5/10	WordPress PB oEmbed HTML5 Audio Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2024-25094	medium	6.5/10	WordPress PJ News Ticker Plugin <= 1.9.5 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2024-25093	high	7.1/10	WordPress GD Rating System Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2024-23501	medium	5.9/10	WordPress Ebook Store Plugin <= 5.788 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2023-50905	high	7.1/10	WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2023-47874	medium	5.4/10	WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Broken Access Control	Feb 29, 2024 2y ago
CVE-2023-6090	critical	9.1/10	WordPress Mollie Payments for WooCommerce Plugin <= 7.3.11 is vulnerable to Arbitrary File Upload	Feb 29, 2024 2y ago
CVE-2024-21752	high	7.1/10	WordPress Ajax Search Lite Plugin <= 4.11.4 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2024-1437	high	7.1/10	WordPress Adsmonetizer Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2024-1434	medium	5.9/10	WordPress Media Alt Renamer Plugin 0.0.1 is vulnerable to Cross Site Scripting (XSS)	Feb 29, 2024 2y ago
CVE-2024-1435	medium	5.3/10	WordPress Tainacan plugin <= 0.20.6 - Sensitive Data Exposure via Log File vulnerability	Feb 29, 2024 2y ago
CVE-2023-51531	medium	5.4/10	WordPress Thrive Automator Plugin <= 1.17 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 29, 2024 2y ago
CVE-2023-51530	medium	4.3/10	WordPress GS Logo Slider Plugin <= 3.5.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 29, 2024 2y ago
CVE-2023-51529	medium	4.3/10	WordPress HT Mega Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 29, 2024 2y ago
CVE-2023-51528	medium	4.3/10	WordPress GPT3 AI Content Writer Plugin <= 1.8.12 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 29, 2024 2y ago
CVE-2023-51696	medium	4.3/10	WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 29, 2024 2y ago
CVE-2024-1468	high	8.8/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload	Feb 29, 2024 2y ago
CVE-2023-51692	medium	4.3/10	WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access Control	Feb 28, 2024 2y ago
CVE-2023-51533	medium	5.4/10	WordPress Ecwid Shopping Cart Plugin <= 6.12.4 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-27948	medium	5.4/10	WordPress Atahualpa Theme <= 3.7.24 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-51683	medium	5.4/10	WordPress Easy PayPal Buy Now Button Plugin <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-51681	medium	6.5/10	WordPress Duplicator Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-52223	medium	5.4/10	WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2023-52226	medium	4.3/10	WordPress Advanced Flamingo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability	Feb 28, 2024 2y ago
CVE-2024-21749	medium	5.4/10	WordPress 1 click disable all Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-23519	medium	4.3/10	WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24701	medium	4.3/10	WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24702	medium	4.3/10	WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-24705	medium	5.4/10	WordPress Accessibility Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago