Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,239

All time

Critical · Active

12,586

CVSS ≥ 9.0

New · 14 days

1,257

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 15421–15450 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-52127	medium	4.3/10	WordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52128	medium	4.3/10	WordPress White Label Plugin <= 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52129	medium	6.3/10	WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52130	medium	4.3/10	WordPress Affiliates Manager Plugin <= 2.9.31 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52136	medium	4.3/10	WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52145	medium	4.3/10	WordPress Republish Old Posts Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52149	medium	5.4/10	WordPress Floating Button Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52150	high	8.8/10	WordPress Dynamic Content for Elementor Plugin < 2.12.5 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-52184	medium	4.3/10	WordPress WP Job Portal Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-51502	high	7.5/10	WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)	Jan 5, 2024 2y ago
CVE-2023-52178	medium	6.5/10	WordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS)	Jan 5, 2024 2y ago
CVE-2023-6524	medium	6.4/10	MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jan 3, 2024 2y ago
CVE-2023-7027	high	7.2/10	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device	Jan 3, 2024 2y ago
CVE-2023-51503	medium	5.9/10	WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)	Dec 31, 2023 2y ago
CVE-2023-51423	critical	9.3/10	WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-51469	critical	9.3/10	WordPress Checkout Mestres WP Plugin <= 7.1.9.6 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-52131	high	7.6/10	WordPress Page Generator Plugin <= 1.7.1 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-51547	high	7.6/10	WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-52132	high	7.6/10	WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-52133	high	8.5/10	WordPress Most And Least Read Posts Widget Plugin <= 2.5.16 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-52134	high	7.6/10	WordPress GEO my WordPress Plugin <= 4.0.2 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-52185	medium	5.3/10	WordPress Everest Backup Plugin <= 2.1.9 is vulnerable to Sensitive Data Exposure	Dec 31, 2023 2y ago
CVE-2023-52180	high	7.6/10	WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.1.0 is vulnerable to SQL Injection	Dec 31, 2023 2y ago
CVE-2023-49777	critical	9.1/10	WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection	Dec 31, 2023 2y ago
CVE-2023-52181	critical	10.0/10	WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection	Dec 31, 2023 2y ago
CVE-2023-39157	critical	9.0/10	WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)	Dec 31, 2023 2y ago
CVE-2023-52182	critical	9.9/10	WordPress ARI Stream Quiz Plugin <= 1.3.0 is vulnerable to PHP Object Injection	Dec 31, 2023 2y ago
CVE-2023-51527	medium	5.3/10	WordPress GPT3 AI Content Writer Plugin <= 1.8.2 is vulnerable to Sensitive Data Exposure	Dec 29, 2023 2y ago
CVE-2023-51688	medium	5.3/10	WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Sensitive Data Exposure	Dec 29, 2023 2y ago
CVE-2023-51687	medium	5.3/10	WordPress Product Catalog Simple Plugin <= 1.7.6 is vulnerable to Sensitive Data Exposure	Dec 29, 2023 2y ago