Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,191

All time

Critical · Active

11,235

CVSS ≥ 9.0

New · 14 days

3,033

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17551–17580 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-39340	medium	4.8/10	Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site Scripting	Nov 1, 2021 4y ago
CVE-2021-24773	—	—	WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting	Nov 1, 2021 4y ago
CVE-2021-26609	high	7.5/10	WordPress Mangboard SQL-Injection vulnerability	Oct 26, 2021 4y ago
CVE-2021-24744	—	—	WordPress Contact Forms by Cimatti < 1.4.12 - Admin+ Stored Cross-Site Scripting	Oct 25, 2021 4y ago
CVE-2021-24544	—	—	Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting	Oct 25, 2021 4y ago
CVE-2021-36869	medium	4.8/10	WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability	Oct 21, 2021 4y ago
CVE-2021-39348	medium	5.5/10	LearnPress – WordPress LMS Plugin <= 4.1.3.1 Authenticated Stored Cross-Site Scripting	Oct 21, 2021 4y ago
CVE-2021-36832	medium	4.8/10	WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Oct 19, 2021 4y ago
CVE-2021-39332	medium	5.5/10	Business Manager – WordPress ERP, HR, CRM, and Project Management Plugin <= 1.4.5 Authenticated Stored Cross-Site Scripting	Oct 15, 2021 4y ago
CVE-2021-24712	—	—	Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSS	Oct 11, 2021 4y ago
CVE-2021-36850	medium	5.4/10	WordPress Media File Renamer – Auto & Manual Rename plugin <= 5.1.9 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 4, 2021 4y ago
CVE-2021-36845	medium	6.9/10	YITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 27, 2021 4y ago
CVE-2021-36841	medium	6.9/10	YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.	Sep 27, 2021 4y ago
CVE-2021-36875	medium	5.9/10	WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36880	high	8.6/10	WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36874	high	7.1/10	WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36877	medium	4.3/10	WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36876	medium	5.4/10	WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 27, 2021 4y ago
CVE-2021-36879	critical	9.8/10	WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability	Sep 27, 2021 4y ago
CVE-2021-36878	medium	4.3/10	WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36823	medium	6.6/10	WordPress Absolutely Glamorous Custom Admin plugin <= 6.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2021 4y ago
CVE-2021-36873	medium	5.5/10	WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Sep 23, 2021 4y ago
CVE-2021-36872	medium	5.5/10	WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Sep 23, 2021 4y ago
CVE-2021-24596	—	—	youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site Scripting	Sep 20, 2021 4y ago
CVE-2021-24403	—	—	WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection	Sep 20, 2021 4y ago
CVE-2021-24623	—	—	WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)	Sep 13, 2021 4y ago
CVE-2021-38359	medium	6.1/10	WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site Scripting	Sep 10, 2021 4y ago
CVE-2021-38340	medium	6.1/10	Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting	Sep 10, 2021 4y ago
CVE-2021-39203	medium	6.8/10	Private data disclosure/privilege escalation through the block editor in Wordpress	Sep 9, 2021 4y ago
CVE-2021-39202	high	7.6/10	WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget	Sep 9, 2021 4y ago