Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,302

All time

Critical · Active

12,587

CVSS ≥ 9.0

New · 14 days

1,306

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 15751–15780 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-49841	medium	5.9/10	WordPress Optin Forms Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49820	medium	6.5/10	WordPress Structured Content Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49813	high	7.1/10	WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49771	high	7.1/10	WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49770	medium	5.9/10	WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49766	high	7.1/10	WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49195	medium	5.9/10	WordPress Nested Pages Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49173	medium	6.5/10	WordPress 10to8 Online Appointment Booking System Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49172	high	7.1/10	WordPress BrainCert – HTML5 Virtual Classroom Plugin <= 1.30 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49171	high	7.1/10	WordPress Innovs HR Plugin <= 1.0.3.4 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49168	medium	6.5/10	WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2022-45365	high	7.1/10	WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49739	high	7.1/10	WordPress PowerPack Pro for Elementor plugin <= 2.9.23 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 14, 2023 2y ago
CVE-2023-49740	high	7.1/10	WordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49743	medium	5.9/10	WordPress Dashboard Widgets Suite Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49745	medium	6.5/10	WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49827	high	7.1/10	WordPress Soledad Theme <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49828	medium	6.5/10	WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49833	medium	6.5/10	WordPress Spectra Plugin <= 2.7.9 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49836	medium	5.9/10	WordPress Cookie Bar Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49846	medium	6.5/10	WordPress Author Avatars List/Block Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-49847	medium	6.5/10	WordPress Annual Archive Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50368	medium	6.5/10	WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.2 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50369	medium	6.5/10	WordPress Alma – Pay in installments or later for WooCommerce Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50370	medium	6.5/10	WordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-50371	medium	6.5/10	WordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)	Dec 14, 2023 2y ago
CVE-2023-45762	medium	4.7/10	WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-47548	medium	4.7/10	WordPress Integrate Google Drive Plugin <= 1.3.2 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-47779	medium	4.7/10	WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open Redirection	Dec 7, 2023 2y ago
CVE-2023-48325	medium	4.7/10	WordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection	Dec 7, 2023 2y ago