Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,069

All time

Critical · Active

12,278

CVSS ≥ 9.0

New · 14 days

1,765

Newly disclosed

Feed last synced

36 mins ago

Data freshness

Showing 15541–15570 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-26525	high	7.1/10	WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-28491	medium	6.7/10	WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-28788	high	7.1/10	WordPress Advanced Page Visit Counter Plugin <= 6.4.2 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-29096	high	8.5/10	WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.0 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-29432	high	8.2/10	WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-30495	high	8.5/10	WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-30750	high	8.5/10	WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-30872	high	7.6/10	WordPress BSK Forms Blacklist Plugin <= 3.6.2 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-31092	medium	5.5/10	WordPress Easy Bet Plugin <= 1.0.2 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-32128	medium	5.5/10	WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations Plugin <= 2.2.7 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-32743	high	7.6/10	WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-33209	high	8.5/10	WordPress SEO Change Monitor Plugin <= 1.2 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-33330	high	8.5/10	WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-49825	high	8.5/10	WordPress Soledad Theme <= 8.4.1 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-49776	critical	9.3/10	WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-49773	critical	10.0/10	WordPress BCorp Shortcodes Plugin <= 0.23 is vulnerable to PHP Object Injection	Dec 20, 2023 2y ago
CVE-2023-49772	critical	10.0/10	WordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object Injection	Dec 20, 2023 2y ago
CVE-2023-35914	high	7.5/10	WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)	Dec 20, 2023 2y ago
CVE-2023-35915	high	7.6/10	WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-35916	high	7.5/10	WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)	Dec 20, 2023 2y ago
CVE-2023-40010	critical	9.3/10	WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-32590	critical	9.3/10	WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-47852	high	8.5/10	WordPress Link Whisper Free Plugin <= 0.6.5 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-28782	high	8.3/10	WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection	Dec 20, 2023 2y ago
CVE-2023-35876	high	8.1/10	WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)	Dec 20, 2023 2y ago
CVE-2023-36520	medium	5.4/10	WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)	Dec 20, 2023 2y ago
CVE-2023-37871	high	8.2/10	WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)	Dec 20, 2023 2y ago
CVE-2023-38513	medium	5.4/10	WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR)	Dec 20, 2023 2y ago
CVE-2023-38519	high	7.6/10	WordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL Injection	Dec 20, 2023 2y ago
CVE-2023-40555	high	8.3/10	WordPress Flatsome Theme <= 3.17.5 is vulnerable to PHP Object Injection	Dec 20, 2023 2y ago