Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,237

All time

Critical · Active

12,586

CVSS ≥ 9.0

New · 14 days

1,264

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15181–15210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-1512	critical	9.8/10	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection	Feb 17, 2024 2y ago
CVE-2024-25914	medium	4.3/10	WordPress SMTP Mail Plugin <= 1.3.20 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 13, 2024 2y ago
CVE-2023-6081	—	—	Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting in New Chart	Feb 12, 2024 2y ago
CVE-2023-6082	—	—	Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting	Feb 12, 2024 2y ago
CVE-2024-0420	—	—	MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS	Feb 12, 2024 2y ago
CVE-2024-0421	—	—	MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure	Feb 12, 2024 2y ago
CVE-2024-24875	medium	4.3/10	WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24884	medium	4.3/10	WordPress Contact Form 7 Connector Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24887	medium	5.4/10	WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24929	medium	4.3/10	WordPress WP Contact Form Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2024-24935	medium	4.3/10	WordPress Basic Log Viewer Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 12, 2024 2y ago
CVE-2023-46615	medium	5.4/10	WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-23512	high	8.7/10	WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-23513	high	8.7/10	WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24796	high	8.2/10	WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24797	critical	9.8/10	WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24926	high	7.5/10	WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-25100	critical	10.0/10	WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability	Feb 12, 2024 2y ago
CVE-2023-47526	medium	5.9/10	WordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-50875	medium	6.5/10	WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-51370	medium	5.9/10	WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-51403	medium	6.5/10	WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24889	medium	6.1/10	WordPress All 404 Pages Redirect to Homepage Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24927	high	7.1/10	WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24928	medium	6.5/10	WordPress Content Cards Plugin <= 0.9.7 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24930	medium	6.5/10	WordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24931	medium	6.5/10	WordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24932	high	7.1/10	WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2024-24933	high	7.1/10	WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)	Feb 12, 2024 2y ago
CVE-2023-51404	medium	6.5/10	WordPress My Agile Privacy Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago