Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,064

All time

Critical · Active

12,278

CVSS ≥ 9.0

New · 14 days

1,763

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15151–15180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-24928	medium	6.5/10	WordPress Content Cards Plugin <= 0.9.7 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24930	medium	6.5/10	WordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24931	medium	6.5/10	WordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24932	high	7.1/10	WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24933	high	7.1/10	WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-51404	medium	6.5/10	WordPress My Agile Privacy Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51415	medium	6.5/10	WordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51480	medium	6.5/10	WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51485	medium	6.5/10	WordPress Pay with Vipps for WooCommerce Plugin <= 1.14.13 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51488	high	7.1/10	WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51492	medium	6.5/10	WordPress If-So Dynamic Content Personalization Plugin <= 1.6.3.1 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51493	medium	6.5/10	WordPress Custom Post Carousels with Owl Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-23514	medium	6.5/10	WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-23516	medium	6.5/10	WordPress CC BMI Calculator Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-23517	medium	6.5/10	WordPress Scheduling Plugin – Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24712	medium	6.5/10	WordPress Heateor Social Login Plugin <= 1.1.30 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24713	medium	6.5/10	WordPress Auto Listings Plugin <= 2.6.5 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24717	medium	5.9/10	WordPress Beds24 Online Booking Plugin <= 2.0.23 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24801	medium	6.5/10	WordPress OWL Carousel Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24803	medium	6.5/10	WordPress Ultra Companion Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24804	medium	6.5/10	WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-24831	medium	6.5/10	WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability	Feb 10, 2024 2y ago
CVE-2024-0596	medium	5.3/10	Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()	Feb 10, 2024 2y ago
CVE-2024-0595	medium	4.3/10	Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()	Feb 10, 2024 2y ago
CVE-2024-0594	high	8.8/10	Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection	Feb 10, 2024 2y ago
CVE-2024-24834	medium	5.9/10	WordPress BEAR Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24836	medium	6.5/10	WordPress GDPR Data Request Form Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24871	medium	6.5/10	WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability	Feb 8, 2024 2y ago
CVE-2024-24877	high	7.1/10	WordPress Wonder Slider Lite Plugin <= 13.9 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24878	high	7.1/10	WordPress Portugal CTT Tracking for WooCommerce plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 8, 2024 2y ago