Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,823

All time

Critical · Active

11,186

CVSS ≥ 9.0

New · 14 days

3,069

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15301–15330 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-49749	medium	4.3/10	WordPress SureTriggers Plugin <= 1.0.23 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 15, 2023 2y ago
CVE-2023-49744	medium	5.4/10	WordPress Gift Up Gift Cards for WordPress and WooCommerce Plugin <= 2.21.3 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 15, 2023 2y ago
CVE-2023-49197	medium	4.3/10	WordPress DoFollow Case by Case Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 15, 2023 2y ago
CVE-2023-49159	high	7.2/10	WordPress CommentLuv Plugin <= 3.0.4 is vulnerable to Server Side Request Forgery (SSRF)	Dec 15, 2023 2y ago
CVE-2023-49829	medium	5.9/10	WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49823	medium	6.5/10	WordPress Bold Page Builder Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49767	medium	5.9/10	WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49747	medium	5.9/10	WordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49191	medium	5.9/10	WordPress GDPR Cookie Consent by Supsystic Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49190	medium	5.9/10	WordPress Site Offline Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49189	medium	5.9/10	WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Plugin <= 4.3.12 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49188	medium	5.9/10	WordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49187	high	7.1/10	WordPress Adifier System Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49185	high	7.1/10	WordPress Doofinder for WooCommerce Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49184	medium	5.9/10	WordPress Parallax Slider Block Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49183	high	7.1/10	WordPress NextScripts Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49181	medium	5.9/10	WordPress WP Event Manager Plugin <= 3.1.40 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49180	medium	5.9/10	WordPress Automatic Youtube Video Posts Plugin Plugin <= 5.2.2 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49179	medium	6.5/10	WordPress Event post Plugin <= 5.8.6 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49178	high	7.1/10	WordPress HDW Player Plugin (Video Player & Video Gallery) Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49177	high	7.1/10	WordPress which template file Plugin <= 4.9.0 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49176	high	7.1/10	WordPress WP Pocket URLs Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49175	medium	5.9/10	WordPress KP Fastest Tawk.to Chat Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49174	medium	5.9/10	WordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49170	high	7.1/10	WordPress Forms by CaptainForm Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49169	medium	6.5/10	WordPress Ads by datafeedr.com Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49165	medium	5.9/10	WordPress Client Dash Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-48765	medium	6.5/10	WordPress Email Address Encoder Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49160	medium	6.5/10	WordPress Formzu WP Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS)	Dec 15, 2023 2y ago
CVE-2023-49157	medium	5.9/10	WordPress Multiple Post Passwords Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago