Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,239

All time

Critical · Active

12,586

CVSS ≥ 9.0

New · 14 days

1,257

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15391–15420 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-52207	critical	9.1/10	WordPress HTML5 MP3 Player with Playlist Free Plugin <= 3.0.0 is vulnerable to PHP Object Injection	Jan 8, 2024 2y ago
CVE-2023-52190	high	7.5/10	WordPress Coupon Referral Program Plugin <= 1.7.2 is vulnerable to Sensitive Data Exposure	Jan 8, 2024 2y ago
CVE-2023-52208	medium	5.3/10	WordPress Constant Contact Forms Plugin <= 2.4.2 is vulnerable to Sensitive Data Exposure	Jan 8, 2024 2y ago
CVE-2023-52222	medium	4.3/10	WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 8, 2024 2y ago
CVE-2023-52215	critical	9.3/10	WordPress Barcode Scanner with Inventory & Order Manager Plugin <=1.5.1 is vulnerable to SQL Injection	Jan 8, 2024 2y ago
CVE-2023-52218	critical	10.0/10	WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection	Jan 8, 2024 2y ago
CVE-2023-52219	critical	9.9/10	WordPress Gecka Terms Thumbnails Plugin <= 1.1 is vulnerable to PHP Object Injection	Jan 8, 2024 2y ago
CVE-2023-52225	critical	10.0/10	WordPress Taggbox Plugin <= 3.1 is vulnerable to PHP Object Injection	Jan 8, 2024 2y ago
CVE-2024-21744	medium	6.5/10	WordPress Mapster WP Maps Plugin <= 1.2.38 is vulnerable to Cross Site Scripting (XSS)	Jan 8, 2024 2y ago
CVE-2024-21745	medium	6.5/10	WordPress Laybuy Payment Extension for WooCommerce Plugin <= 5.3.9 is vulnerable to Cross Site Scripting (XSS)	Jan 8, 2024 2y ago
CVE-2024-21747	high	7.6/10	WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection	Jan 8, 2024 2y ago
CVE-2023-52124	medium	6.5/10	WordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)	Jan 5, 2024 2y ago
CVE-2023-52125	medium	6.5/10	WordPress iFrame Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)	Jan 5, 2024 2y ago
CVE-2023-52126	medium	5.3/10	WordPress Send Users Email Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure	Jan 5, 2024 2y ago
CVE-2023-52143	high	7.5/10	WordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data Exposure	Jan 5, 2024 2y ago
CVE-2023-52146	medium	5.3/10	WordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data Exposure	Jan 5, 2024 2y ago
CVE-2023-52148	medium	5.3/10	WordPress Affiliates Manager Plugin <= 2.9.30 is vulnerable to Sensitive Data Exposure	Jan 5, 2024 2y ago
CVE-2023-52151	medium	5.3/10	WordPress Uncanny Automator Plugin <= 5.1.0.2 is vulnerable to Sensitive Data Exposure	Jan 5, 2024 2y ago
CVE-2022-46839	critical	10.0/10	WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload	Jan 5, 2024 2y ago
CVE-2023-51678	medium	4.3/10	WordPress Doofinder for WooCommerce Plugin <= 2.0.33 is vulnerable to Broken Access Control	Jan 5, 2024 2y ago
CVE-2023-51535	medium	4.3/10	WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-51673	medium	5.4/10	WordPress Stylish Price List Plugin <= 7.0.17 is vulnerable to Broken Access Control	Jan 5, 2024 2y ago
CVE-2023-51668	medium	4.3/10	WordPress Inline Image Upload for BBPress Plugin <= 1.1.18 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-51538	medium	4.3/10	WordPress Awesome Support Plugin <= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-51539	medium	5.4/10	WordPress Apollo13 Framework Extensions Plugin <= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52119	medium	4.3/10	WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52120	medium	5.4/10	WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52121	medium	5.4/10	WordPress NitroPack Plugin <= 1.10.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52122	medium	4.3/10	WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52123	medium	4.3/10	WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago