Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

336,925

All time

Critical · Active

10,649

CVSS ≥ 9.0

New · 14 days

1,571

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1861–1890 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25333	medium	5.3/10	WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25332	medium	5.3/10	WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25331	medium	6.5/10	WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25330	medium	4.3/10	WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25329	medium	4.3/10	WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25326	high	7.5/10	WordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25325	medium	5.3/10	WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25324	medium	5.3/10	WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25323	medium	4.3/10	WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25322	medium	5.4/10	WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25321	medium	5.3/10	WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25320	medium	5.3/10	WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25319	medium	4.3/10	WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25318	medium	4.3/10	WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25316	high	7.2/10	WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25315	medium	5.3/10	WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25314	medium	4.3/10	WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25313	medium	4.3/10	WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25311	medium	5.4/10	WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25310	medium	4.9/10	WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25308	medium	4.3/10	WordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25307	medium	6.5/10	WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25305	medium	6.5/10	WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25008	medium	4.3/10	WordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25006	medium	5.3/10	WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25005	medium	5.3/10	WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25004	medium	5.9/10	WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25003	medium	4.3/10	WordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25000	medium	5.3/10	WordPress Wheel of Life plugin <= 1.2.0 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-24999	medium	5.3/10	WordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago