Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,805

All time

Critical · Active

11,186

CVSS ≥ 9.0

New · 14 days

3,068

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15241–15270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-41648	medium	4.7/10	WordPress Login and Logout Redirect Plugin <= 2.0.3 is vulnerable to Open Redirection	Dec 19, 2023 2y ago
CVE-2023-45105	medium	4.7/10	WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open Redirection	Dec 19, 2023 2y ago
CVE-2023-34027	high	8.3/10	WordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection	Dec 19, 2023 2y ago
CVE-2023-34382	medium	4.4/10	WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection	Dec 19, 2023 2y ago
CVE-2023-37390	high	8.3/10	WordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection	Dec 19, 2023 2y ago
CVE-2023-25715	medium	5.4/10	WordPress GamiPress Plugin <= 2.5.6 is vulnerable to Broken Access Control	Dec 19, 2023 2y ago
CVE-2023-44991	medium	6.5/10	WordPress Media File Renamer Plugin <= 5.6.9 is vulnerable to Sensitive Data Exposure	Dec 19, 2023 2y ago
CVE-2023-44983	medium	5.3/10	WordPress Aruba HiSpeed Cache Plugin <= 2.0.6 is vulnerable to Sensitive Data Exposure	Dec 19, 2023 2y ago
CVE-2023-50376	high	7.1/10	WordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)	Dec 19, 2023 2y ago
CVE-2023-44982	medium	5.3/10	WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure	Dec 19, 2023 2y ago
CVE-2023-46212	medium	6.3/10	WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control	Dec 18, 2023 2y ago
CVE-2023-46154	medium	6.6/10	WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection	Dec 18, 2023 2y ago
CVE-2023-47754	medium	4.3/10	WordPress Delete Duplicate Posts Plugin <= 4.8.9 is vulnerable to Broken Access Control	Dec 18, 2023 2y ago
CVE-2023-48751	medium	4.3/10	WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control	Dec 18, 2023 2y ago
CVE-2023-49819	high	7.5/10	WordPress Structured Content Plugin <= 1.5.3 is vulnerable to PHP Object Injection	Dec 18, 2023 2y ago
CVE-2022-45809	medium	5.3/10	WordPress Thumbs Rating Plugin <= 5.0.0 is vulnerable to Race Condition	Dec 18, 2023 2y ago
CVE-2023-47506	high	7.6/10	WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to SQL Injection	Dec 18, 2023 2y ago
CVE-2023-47530	high	7.6/10	WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection	Dec 18, 2023 2y ago
CVE-2023-47558	high	7.6/10	WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to SQL Injection	Dec 18, 2023 2y ago
CVE-2023-33331	high	8.5/10	WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection	Dec 18, 2023 2y ago
CVE-2023-34168	high	7.6/10	WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL Injection	Dec 18, 2023 2y ago
CVE-2023-49821	medium	5.4/10	WordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49763	medium	4.3/10	WordPress CSprite Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49761	medium	5.4/10	WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49760	medium	5.4/10	WordPress WPsoonOnlinePage Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49759	medium	5.4/10	WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49163	medium	5.4/10	WordPress teachPress Plugin <= 9.0.5 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49155	medium	4.3/10	WordPress Button Generator – easily Button Builder Plugin <= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49153	medium	4.3/10	WordPress Add to Cart Text Changer and Customize Button, Add Custom Icon Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago
CVE-2023-49148	medium	5.4/10	WordPress Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates Plugin <= 3.0.5 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 18, 2023 2y ago