Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,839

All time

Critical · Active

11,190

CVSS ≥ 9.0

New · 14 days

3,065

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15361–15390 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-49836	medium	5.9/10	WordPress Cookie Bar Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49846	medium	6.5/10	WordPress Author Avatars List/Block Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49847	medium	6.5/10	WordPress Annual Archive Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50368	medium	6.5/10	WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.2 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50369	medium	6.5/10	WordPress Alma – Pay in installments or later for WooCommerce Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50370	medium	6.5/10	WordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50371	medium	6.5/10	WordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-45762	medium	4.7/10	WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-47548	medium	4.7/10	WordPress Integrate Google Drive Plugin <= 1.3.2 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-47779	medium	4.7/10	WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-48325	medium	4.7/10	WordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-35039	critical	9.8/10	WordPress Password Reset with Code for WordPress REST API Plugin <= 0.0.15 is vulnerable to Broken Authentication	Dec 7, 2023 2y ago
CVE-2023-35909	medium	5.3/10	WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack	Dec 7, 2023 2y ago
CVE-2022-45362	high	7.2/10	WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-41804	high	7.1/10	WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-46641	medium	4.9/10	WordPress 12 Step Meeting List Plugin <= 3.14.24 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-49746	medium	4.9/10	WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-5979	—	—	eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF	Dec 4, 2023 2y ago
CVE-2023-47870	high	7.1/10	WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)	Nov 30, 2023 2y ago
CVE-2023-34018	medium	5.9/10	WordPress SoundCloud Shortcode Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47521	high	7.1/10	WordPress Q2W3 Post Order Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-38400	high	7.1/10	WordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47844	high	7.1/10	WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47848	high	7.1/10	WordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47853	medium	6.5/10	WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47872	medium	6.5/10	WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47876	high	7.1/10	WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47877	medium	6.5/10	WordPress Perfmatters Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48272	high	7.1/10	WordPress Maspik – Spam blacklist Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48317	medium	6.5/10	WordPress Display Custom Post Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago