Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,978

All time

Critical · Active

11,209

CVSS ≥ 9.0

New · 14 days

3,082

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 16231–16260 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-34011	high	7.1/10	WordPress ShopConstruct Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-37986	medium	5.9/10	WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-37893	high	7.1/10	WordPress Coming Soon Chop Chop Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-25488	medium	5.9/10	WordPress WP Default Feature Image Plugin <= 1.0.1.1 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-25044	medium	5.9/10	WordPress Social Share Boost Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-25042	medium	5.9/10	WordPress oAuth Twitter Feed for Developers Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-24412	medium	5.9/10	WordPress Image Social Feed Plugin Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-25477	medium	5.9/10	WordPress Video Gallery Plugin <= 1.3.12 is vulnerable to Cross Site Scripting (XSS)	Sep 1, 2023 2y ago
CVE-2023-27621	medium	5.9/10	WordPress Livestream Notice Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-24401	medium	5.9/10	WordPress Mobile Call Now & Map Buttons Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-24397	medium	5.9/10	WordPress Reservation.Studio widget Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-25471	high	7.1/10	WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-28415	medium	5.9/10	WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-28692	medium	5.9/10	WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-25466	medium	5.8/10	WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-35092	medium	5.9/10	WordPress breadcrumb simple Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-35094	medium	6.5/10	WordPress WP Matterport Shortcode Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-25453	high	7.1/10	WordPress WordPress Tables Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34372	medium	5.9/10	WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-32294	medium	5.9/10	WordPress GDPR Cookie Consent Notice Box Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34004	medium	6.5/10	WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34008	high	7.1/10	WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34022	high	7.1/10	WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34023	high	7.1/10	WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34032	high	7.1/10	WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34172	medium	5.9/10	WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34173	medium	5.9/10	WordPress Yandex Metrica Counter Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34174	high	7.1/10	WordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34180	high	7.1/10	WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago
CVE-2023-34175	high	7.1/10	WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 2y ago