Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,227

All time

Critical · Active

12,289

CVSS ≥ 9.0

New · 14 days

1,728

Newly disclosed

Feed last synced

39 mins ago

Data freshness

Showing 17941–17969 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-32770	high	7.5/10	Basic-auth app bundle credential exposure in gatsby-source-wordpress	Jul 15, 2021 5y ago
CVE-2021-24343	—	—	iFlyChat – WordPress Chat < 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS)	Jun 7, 2021 5y ago
CVE-2021-24334	—	—	Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFS	Jun 1, 2021 5y ago
CVE-2021-24322	—	—	Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS)	Jun 1, 2021 5y ago
CVE-2021-29450	medium	6.5/10	WordPress Authenticated disclosure of password-protected posts and pages	Apr 15, 2021 5y ago
CVE-2021-29447	high	7.1/10	WordPress Authenticated XXE attack when installation is running PHP 8	Apr 15, 2021 5y ago
CVE-2021-24231	—	—	Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon	Apr 12, 2021 5y ago
CVE-2021-24230	—	—	Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta	Apr 12, 2021 5y ago
CVE-2021-24229	—	—	Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action	Apr 12, 2021 5y ago
CVE-2021-24228	—	—	Patreon WordPress < 1.7.2 - Reflected XSS on Login Form	Apr 12, 2021 5y ago
CVE-2021-24227	—	—	Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure	Apr 12, 2021 5y ago
CVE-2021-24218	—	—	Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion	Apr 12, 2021 5y ago
CVE-2021-24217	—	—	Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain	Apr 12, 2021 5y ago
CVE-2021-24211	—	—	WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)	Apr 5, 2021 5y ago
CVE-2021-24180	—	—	Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)	Apr 5, 2021 5y ago
CVE-2020-4047	medium	6.8/10	Authenticated XSS via media attachment page in WordPress	Jun 12, 2020 6y ago
CVE-2020-4048	medium	5.7/10	Open redirect in wp_validate_redirect() in WordPress	Jun 12, 2020 6y ago
CVE-2020-4049	low	2.4/10	Authenticated self-XSS via theme uploads in WordPress	Jun 12, 2020 6y ago
CVE-2020-4050	low	3.5/10	set-screen-option filter misuse by plugins leading to privilege escalation in WordPress	Jun 12, 2020 6y ago
CVE-2020-4046	medium	5.4/10	Authenticated XSS through embed block in WordPress	Jun 12, 2020 6y ago
CVE-2020-11026	high	8.7/10	Specially crafted filenames in WordPress leading to XSS	Apr 30, 2020 6y ago
CVE-2020-11028	medium	5.8/10	Unauthenticated disclosure of certain private posts in WordPress	Apr 30, 2020 6y ago
CVE-2020-11029	medium	5.8/10	Cross-site scripting in stats method (object cache) in WordPress	Apr 30, 2020 6y ago
CVE-2020-11030	medium	6.4/10	Cross-site scripting (XSS) in Search block in WordPress	Apr 30, 2020 6y ago
CVE-2020-11025	medium	5.8/10	Authenticated cross-site scripting (XSS) in WordPress Customizer	Apr 30, 2020 6y ago
CVE-2020-11027	medium	6.1/10	Password reset links invalidation issue in WordPress	Apr 30, 2020 6y ago
CVE-2019-16781	medium	5.8/10	Stored cross-site scripting (XSS) in WordPress block editor	Dec 26, 2019 6y ago
CVE-2019-16780	medium	5.8/10	Stored cross-site scripting (XSS) in WordPress block editor	Dec 26, 2019 6y ago
CVE-2016-6565	—	—	The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious file	Jul 13, 2018 8y ago