Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,238

All time

Critical · Active

12,586

CVSS ≥ 9.0

New · 14 days

1,256

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 15331–15360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-52187	medium	5.3/10	WordPress Image Source Control Plugin <= 2.17.0 is vulnerable to Sensitive Data Exposure	Jan 26, 2024 2y ago
CVE-2024-22141	medium	6.5/10	WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22154	high	7.5/10	WordPress SalesKing Plugin <= 1.6.15 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22294	medium	5.3/10	WordPress Download IP2Location Country Blocker Plugin <= 2.33.3 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22301	medium	5.3/10	WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Sensitive Data Exposure	Jan 24, 2024 2y ago
CVE-2024-22308	low	3.4/10	WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection	Jan 24, 2024 2y ago
CVE-2023-52221	critical	10.0/10	WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.1 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22135	high	8.0/10	WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22152	high	8.0/10	WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22284	high	8.7/10	WordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object Injection	Jan 24, 2024 2y ago
CVE-2024-22309	high	8.7/10	WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection	Jan 24, 2024 2y ago
CVE-2024-22134	medium	4.9/10	WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF)	Jan 24, 2024 2y ago
CVE-2022-47160	medium	6.5/10	WordPress Wp Social Plugin <= 1.9.0 is vulnerable to Sensitive Data Exposure	Jan 19, 2024 2y ago
CVE-2022-45845	medium	4.3/10	WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection	Jan 19, 2024 2y ago
CVE-2022-45083	medium	6.6/10	WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection	Jan 19, 2024 2y ago
CVE-2022-40700	high	8.2/10	Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins	Jan 19, 2024 2y ago
CVE-2022-42884	medium	5.4/10	WordPress WIP Custom Login Plugin <= 1.2.7 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41790	medium	4.3/10	WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41786	medium	5.4/10	WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41695	medium	5.4/10	WordPress Traffic Manager Plugin <= 1.4.5 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41619	medium	5.4/10	WordPress Image Zoom Plugin <= 1.8.8 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-40702	medium	5.4/10	WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41990	high	7.1/10	WordPress 3D Tag Cloud Plugin <= 3.8 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 17, 2024 2y ago
CVE-2023-34379	medium	5.4/10	WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-40203	medium	6.3/10	WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-38141	medium	4.3/10	WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-36418	medium	6.5/10	WordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken Authentication	Jan 17, 2024 2y ago
CVE-2023-6592	—	—	FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure	Jan 16, 2024 2y ago
CVE-2023-3211	—	—	WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection	Jan 16, 2024 2y ago
CVE-2023-5905	—	—	DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export	Jan 15, 2024 2y ago