Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,209

All time

Critical · Active

11,237

CVSS ≥ 9.0

New · 14 days

3,044

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17611–17620 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2020-4046	medium	5.4/10	Authenticated XSS through embed block in WordPress	Jun 12, 2020 6y ago
CVE-2020-11026	high	8.7/10	Specially crafted filenames in WordPress leading to XSS	Apr 30, 2020 6y ago
CVE-2020-11028	medium	5.8/10	Unauthenticated disclosure of certain private posts in WordPress	Apr 30, 2020 6y ago
CVE-2020-11029	medium	5.8/10	Cross-site scripting in stats method (object cache) in WordPress	Apr 30, 2020 6y ago
CVE-2020-11030	medium	6.4/10	Cross-site scripting (XSS) in Search block in WordPress	Apr 30, 2020 6y ago
CVE-2020-11025	medium	5.8/10	Authenticated cross-site scripting (XSS) in WordPress Customizer	Apr 30, 2020 6y ago
CVE-2020-11027	medium	6.1/10	Password reset links invalidation issue in WordPress	Apr 30, 2020 6y ago
CVE-2019-16781	medium	5.8/10	Stored cross-site scripting (XSS) in WordPress block editor	Dec 26, 2019 6y ago
CVE-2019-16780	medium	5.8/10	Stored cross-site scripting (XSS) in WordPress block editor	Dec 26, 2019 6y ago
CVE-2016-6565	—	—	The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious file	Jul 13, 2018 8y ago