Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,290

All time

Critical · Active

12,587

CVSS ≥ 9.0

New · 14 days

1,306

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15541–15570 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-50836	medium	5.9/10	WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)	Dec 28, 2023 2y ago
CVE-2023-50859	medium	6.5/10	WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)	Dec 28, 2023 2y ago
CVE-2023-50860	medium	6.5/10	WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)	Dec 28, 2023 2y ago
CVE-2023-50874	medium	6.5/10	WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)	Dec 28, 2023 2y ago
CVE-2023-51501	high	7.1/10	WordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)	Dec 28, 2023 2y ago
CVE-2023-51700	medium	6.4/10	WP-Mobile-BankID-Integration WordPress Database Deserialization: Potential for Object Injection	Dec 27, 2023 2y ago
CVE-2023-5939	—	—	rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCE	Dec 26, 2023 2y ago
CVE-2023-5931	—	—	rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE	Dec 26, 2023 2y ago
CVE-2023-49765	medium	4.3/10	WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR)	Dec 21, 2023 2y ago
CVE-2023-47191	medium	6.5/10	WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR)	Dec 21, 2023 2y ago
CVE-2023-32799	medium	6.5/10	WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR)	Dec 21, 2023 2y ago
CVE-2023-32747	medium	5.4/10	WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)	Dec 21, 2023 2y ago
CVE-2023-50834	medium	6.5/10	WordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50833	medium	6.5/10	WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50832	medium	5.9/10	WordPress Multi Step Form Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50831	medium	6.5/10	WordPress CURCY Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50830	medium	5.9/10	WordPress Seos Contact Form Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50829	medium	5.9/10	WordPress Loan Repayment Calculator and Application Form Plugin <= 2.9.3 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50828	medium	5.9/10	WordPress Ultimate Dashboard Plugin <= 3.7.11 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50827	medium	5.9/10	WordPress Accredible Certificates & Open Badges Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50826	medium	5.9/10	WordPress Menu Image, Icons made easy Plugin <= 3.10 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50825	medium	6.5/10	WordPress iframe Shortcode Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50824	medium	6.5/10	WordPress Insert or Embed Articulate Content into WordPress Plugin <= 4.3000000021 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50823	medium	6.5/10	WordPress CSS & JavaScript Toolbox Plugin <= 11.7 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50822	medium	6.5/10	WordPress Currency Converter Widget Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-50377	medium	5.9/10	WordPress Simple Counter Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-47527	medium	5.9/10	WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-47525	medium	5.9/10	WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2023-22674	medium	5.4/10	WordPress Dashicons + Custom Post Types Plugin <= 1.0.2 is vulnerable to Broken Access Control	Dec 21, 2023 2y ago
CVE-2023-28421	medium	5.3/10	WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.10 is vulnerable to Sensitive Data Exposure	Dec 21, 2023 2y ago