Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,209

All time

Critical · Active

11,237

CVSS ≥ 9.0

New · 14 days

3,045

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17581–17610 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-39201	high	7.6/10	Authenticated cross-site scripting (XSS) in WordPress editor	Sep 9, 2021 4y ago
CVE-2021-39200	medium	5.3/10	Information Disclosure in wp_die() via JSONP in wordpress	Sep 9, 2021 4y ago
CVE-2021-36871	medium	5.5/10	WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities	Sep 9, 2021 4y ago
CVE-2021-36870	medium	5.5/10	WordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilities	Sep 9, 2021 4y ago
CVE-2021-24392	—	—	WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL Injection	Sep 6, 2021 4y ago
CVE-2021-34668	medium	6.4/10	WordPress Real Media Library <= 4.14.1 Author-only Stored Cross-Site Scripting	Aug 30, 2021 4y ago
CVE-2021-24380	—	—	Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF	Aug 16, 2021 4y ago
CVE-2021-34638	medium	6.5/10	WordPress Download Manager <= 3.1.24 Authenticated Directory Traversal	Aug 5, 2021 4y ago
CVE-2021-34639	high	7.5/10	WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload	Aug 5, 2021 4y ago
CVE-2021-34619	high	8.8/10	Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin	Jul 21, 2021 5y ago
CVE-2021-24482	—	—	Related Posts for WordPress <= 2.0.4 - Authenticated Stored XSS & XFS	Jul 19, 2021 5y ago
CVE-2021-32770	high	7.5/10	Basic-auth app bundle credential exposure in gatsby-source-wordpress	Jul 15, 2021 5y ago
CVE-2021-24343	—	—	iFlyChat – WordPress Chat < 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS)	Jun 7, 2021 5y ago
CVE-2021-24334	—	—	Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFS	Jun 1, 2021 5y ago
CVE-2021-24322	—	—	Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS)	Jun 1, 2021 5y ago
CVE-2021-29450	medium	6.5/10	WordPress Authenticated disclosure of password-protected posts and pages	Apr 15, 2021 5y ago
CVE-2021-29447	high	7.1/10	WordPress Authenticated XXE attack when installation is running PHP 8	Apr 15, 2021 5y ago
CVE-2021-24231	—	—	Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon	Apr 12, 2021 5y ago
CVE-2021-24230	—	—	Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta	Apr 12, 2021 5y ago
CVE-2021-24229	—	—	Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action	Apr 12, 2021 5y ago
CVE-2021-24228	—	—	Patreon WordPress < 1.7.2 - Reflected XSS on Login Form	Apr 12, 2021 5y ago
CVE-2021-24227	—	—	Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure	Apr 12, 2021 5y ago
CVE-2021-24218	—	—	Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion	Apr 12, 2021 5y ago
CVE-2021-24217	—	—	Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain	Apr 12, 2021 5y ago
CVE-2021-24211	—	—	WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)	Apr 5, 2021 5y ago
CVE-2021-24180	—	—	Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)	Apr 5, 2021 5y ago
CVE-2020-4047	medium	6.8/10	Authenticated XSS via media attachment page in WordPress	Jun 12, 2020 6y ago
CVE-2020-4048	medium	5.7/10	Open redirect in wp_validate_redirect() in WordPress	Jun 12, 2020 6y ago
CVE-2020-4049	low	2.4/10	Authenticated self-XSS via theme uploads in WordPress	Jun 12, 2020 6y ago
CVE-2020-4050	low	3.5/10	set-screen-option filter misuse by plugins leading to privilege escalation in WordPress	Jun 12, 2020 6y ago