Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,239

All time

Critical · Active

12,586

CVSS ≥ 9.0

New · 14 days

1,257

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 15451–15480 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-51517	medium	4.1/10	WordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open Redirection	Dec 29, 2023 2y ago
CVE-2023-51675	medium	4.7/10	WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection	Dec 29, 2023 2y ago
CVE-2023-51410	critical	9.9/10	WordPress WP Mail Log Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51411	critical	10.0/10	WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51412	critical	9.0/10	WordPress Piotnet Forms Plugin <= 1.0.25 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51417	critical	9.9/10	WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51419	critical	10.0/10	WordPress BERTHA AI Plugin <= 1.11.10.7 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51421	critical	9.9/10	WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51468	critical	10.0/10	WordPress Rencontre – Dating Site Plugin <= 3.10.1 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51473	critical	10.0/10	WordPress TerraClassifieds Plugin <= 2.0.3 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51475	critical	10.0/10	WordPress WP MLM Unilevel Plugin <= 4.0 is vulnerable to Arbitrary File Upload	Dec 29, 2023 2y ago
CVE-2023-51414	critical	9.6/10	WordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection	Dec 29, 2023 2y ago
CVE-2023-51422	critical	9.9/10	WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to PHP Object Injection	Dec 29, 2023 2y ago
CVE-2023-51470	critical	9.9/10	WordPress Rencontre – Dating Site Plugin <= 3.11.1 is vulnerable to PHP Object Injection	Dec 29, 2023 2y ago
CVE-2023-51505	critical	10.0/10	WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection	Dec 29, 2023 2y ago
CVE-2023-51545	critical	9.6/10	WordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection	Dec 29, 2023 2y ago
CVE-2023-51676	medium	4.9/10	WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF)	Dec 29, 2023 2y ago
CVE-2023-50878	medium	5.4/10	WordPress MStore API Plugin <= 4.10.1 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 29, 2023 2y ago
CVE-2023-50902	medium	4.3/10	WordPress New User Approve Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 29, 2023 2y ago
CVE-2023-51354	medium	4.3/10	WordPress Webba Booking Plugin <= 4.5.33 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 29, 2023 2y ago
CVE-2023-51358	medium	5.4/10	WordPress Block IPs for Gravity Forms Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 29, 2023 2y ago
CVE-2023-51378	medium	5.4/10	WordPress Rise Blocks Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 29, 2023 2y ago
CVE-2023-51402	medium	4.3/10	WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.17 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 29, 2023 2y ago
CVE-2023-50837	high	7.6/10	WordPress Login Lockdown Plugin <= 2.06 is vulnerable to SQL Injection	Dec 29, 2023 2y ago
CVE-2023-50879	medium	6.5/10	WordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)	Dec 29, 2023 2y ago
CVE-2023-50880	medium	6.5/10	WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)	Dec 29, 2023 2y ago
CVE-2023-50881	medium	6.5/10	WordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS)	Dec 29, 2023 2y ago
CVE-2023-50889	medium	6.5/10	WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)	Dec 29, 2023 2y ago
CVE-2023-50891	medium	6.5/10	WordPress Zoho Forms Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)	Dec 29, 2023 2y ago
CVE-2023-50892	high	7.1/10	WordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)	Dec 29, 2023 2y ago