Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,227

All time

Critical · Active

12,289

CVSS ≥ 9.0

New · 14 days

1,728

Newly disclosed

Feed last synced

27 mins ago

Data freshness

Showing 17911–17940 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-36845	medium	6.9/10	YITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 27, 2021 4y ago
CVE-2021-36841	medium	6.9/10	YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.	Sep 27, 2021 4y ago
CVE-2021-36875	medium	5.9/10	WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36880	high	8.6/10	WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36874	high	7.1/10	WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36877	medium	4.3/10	WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36876	medium	5.4/10	WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 27, 2021 4y ago
CVE-2021-36879	critical	9.8/10	WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability	Sep 27, 2021 4y ago
CVE-2021-36878	medium	4.3/10	WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability	Sep 27, 2021 4y ago
CVE-2021-36823	medium	6.6/10	WordPress Absolutely Glamorous Custom Admin plugin <= 6.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2021 4y ago
CVE-2021-36873	medium	5.5/10	WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Sep 23, 2021 4y ago
CVE-2021-36872	medium	5.5/10	WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Sep 23, 2021 4y ago
CVE-2021-24596	—	—	youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site Scripting	Sep 20, 2021 4y ago
CVE-2021-24403	—	—	WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection	Sep 20, 2021 4y ago
CVE-2021-24623	—	—	WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)	Sep 13, 2021 4y ago
CVE-2021-38359	medium	6.1/10	WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site Scripting	Sep 10, 2021 5y ago
CVE-2021-38340	medium	6.1/10	Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting	Sep 10, 2021 5y ago
CVE-2021-39203	medium	6.8/10	Private data disclosure/privilege escalation through the block editor in Wordpress	Sep 9, 2021 5y ago
CVE-2021-39202	high	7.6/10	WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget	Sep 9, 2021 5y ago
CVE-2021-39201	high	7.6/10	Authenticated cross-site scripting (XSS) in WordPress editor	Sep 9, 2021 5y ago
CVE-2021-39200	medium	5.3/10	Information Disclosure in wp_die() via JSONP in wordpress	Sep 9, 2021 5y ago
CVE-2021-36871	medium	5.5/10	WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities	Sep 9, 2021 5y ago
CVE-2021-36870	medium	5.5/10	WordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilities	Sep 9, 2021 5y ago
CVE-2021-24392	—	—	WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL Injection	Sep 6, 2021 5y ago
CVE-2021-34668	medium	6.4/10	WordPress Real Media Library <= 4.14.1 Author-only Stored Cross-Site Scripting	Aug 30, 2021 5y ago
CVE-2021-24380	—	—	Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF	Aug 16, 2021 5y ago
CVE-2021-34638	medium	6.5/10	WordPress Download Manager <= 3.1.24 Authenticated Directory Traversal	Aug 5, 2021 5y ago
CVE-2021-34639	high	7.5/10	WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload	Aug 5, 2021 5y ago
CVE-2021-34619	high	8.8/10	Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin	Jul 21, 2021 5y ago
CVE-2021-24482	—	—	Related Posts for WordPress <= 2.0.4 - Authenticated Stored XSS & XFS	Jul 19, 2021 5y ago