Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,192

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,735

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17281–17310 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-25062	medium	5.9/10	WordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24378	medium	6.5/10	WordPress Glossary Plugin <= 2.1.27 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24374	medium	6.5/10	WordPress Material Design Icons for Page Builders Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24396	medium	5.9/10	WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2022-46793	medium	5.4/10	WordPress Product Feed PRO for WooCommerce Plugin <= 12.4.4 is vulnerable to Cross Site Request Forgery (CSRF)	Apr 6, 2023 3y ago
CVE-2023-24387	medium	5.9/10	WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24411	medium	6.5/10	WordPress BNE Testimonials Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24403	medium	5.9/10	WordPress bbPress Voting Plugin <= 2.1.11.0 is vulnerable to Cross-Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24383	medium	5.9/10	WordPress Namaste! LMS Plugin <= 2.5.9.1 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23898	medium	5.5/10	WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24003	medium	6.5/10	WordPress WP Popups Plugin <= 2.1.4.8 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24002	medium	5.9/10	WordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24004	medium	5.9/10	WordPress Image and Video Lightbox, Image PopUp Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24006	medium	5.9/10	WordPress WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups Plugin <= 2.6.0 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-24001	medium	5.9/10	WordPress Modal Dialog Plugin <= 3.5.9 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23996	medium	5.9/10	WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23998	medium	5.9/10	WordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23980	medium	5.9/10	WordPress MailOptin Plugin <= 1.2.54.0 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23972	medium	5.9/10	WordPress Social Like Box and Page by WpDevArt Plugin <= 0.8.39 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23987	medium	5.9/10	WordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23979	high	7.1/10	WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23971	medium	5.9/10	WordPress WP Time Slots Booking Form Plugin <= 1.1.81 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23982	medium	5.9/10	WordPress WPFrom Email Plugin <= 1.8.8 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-23981	medium	5.9/10	WordPress Conversational Forms for ChatBot Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)	Apr 6, 2023 3y ago
CVE-2023-26536	medium	6.5/10	WordPress Sp*tify Play Button for WordPress Plugin <= 2.05 is vulnerable to Cross Site Scripting (XSS)	Apr 5, 2023 3y ago
CVE-2023-1840	medium	4.4/10	Sp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scripting	Apr 4, 2023 3y ago
CVE-2023-23977	medium	6.5/10	WordPress Heateor Social Comments Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)	Apr 4, 2023 3y ago
CVE-2022-41633	medium	5.4/10	WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF)	Apr 4, 2023 3y ago
CVE-2023-26529	medium	5.9/10	WordPress DupeOff Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)	Apr 3, 2023 3y ago
CVE-2023-24399	medium	5.5/10	WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)	Mar 30, 2023 3y ago