Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,069

All time

Critical · Active

12,278

CVSS ≥ 9.0

New · 14 days

1,761

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15721–15750 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-47779	medium	4.7/10	WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-48325	medium	4.7/10	WordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-35039	critical	9.8/10	WordPress Password Reset with Code for WordPress REST API Plugin <= 0.0.15 is vulnerable to Broken Authentication	Dec 7, 2023 2y ago
CVE-2023-35909	medium	5.3/10	WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack	Dec 7, 2023 2y ago
CVE-2022-45362	high	7.2/10	WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-41804	high	7.1/10	WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-46641	medium	4.9/10	WordPress 12 Step Meeting List Plugin <= 3.14.24 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-49746	medium	4.9/10	WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF)	Dec 7, 2023 2y ago
CVE-2023-5979	—	—	eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF	Dec 4, 2023 2y ago
CVE-2023-47870	high	7.1/10	WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)	Nov 30, 2023 2y ago
CVE-2023-34018	medium	5.9/10	WordPress SoundCloud Shortcode Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47521	high	7.1/10	WordPress Q2W3 Post Order Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-38400	high	7.1/10	WordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47844	high	7.1/10	WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47848	high	7.1/10	WordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47853	medium	6.5/10	WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47872	medium	6.5/10	WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47876	high	7.1/10	WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47877	medium	6.5/10	WordPress Perfmatters Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48272	high	7.1/10	WordPress Maspik – Spam blacklist Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48317	medium	6.5/10	WordPress Display Custom Post Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48320	medium	5.9/10	WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48321	medium	6.5/10	WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48746	high	7.1/10	WordPress Community by PeepSo Plugin <= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48748	high	7.1/10	WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48752	high	7.1/10	WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-48749	medium	6.5/10	WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)	Nov 30, 2023 2y ago
CVE-2023-47875	medium	5.4/10	WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)	Nov 30, 2023 2y ago
CVE-2023-48278	high	7.1/10	WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to XSS	Nov 30, 2023 2y ago
CVE-2023-48328	medium	4.3/10	WordPress NextGEN Gallery Plugin <= 3.37 is vulnerable to Cross Site Request Forgery (CSRF)	Nov 30, 2023 2y ago