Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,503

All time

Critical · Active

12,230

CVSS ≥ 9.0

New · 14 days

3,116

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 2101–2130 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-27990	high	8.1/10	WordPress ConFix theme <= 1.013 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27989	high	8.1/10	WordPress Quanzo theme <= 1.0.10 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27988	high	8.1/10	WordPress Equadio theme <= 1.1.3 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27987	high	8.1/10	WordPress The Qlean theme <= 2.12 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27986	high	8.1/10	WordPress OsTende theme <= 1.4.3 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27985	high	8.1/10	WordPress Humanum theme <= 1.1.4 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27984	critical	9.0/10	WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27983	critical	9.8/10	WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27541	high	7.2/10	WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27439	critical	9.8/10	WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27438	critical	9.8/10	WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27437	critical	9.8/10	WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27428	high	8.5/10	WordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27417	critical	9.8/10	WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27411	medium	5.4/10	WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27406	high	7.5/10	WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27396	high	7.3/10	WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27390	high	8.8/10	WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27389	critical	9.8/10	WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27388	high	7.5/10	WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27386	high	7.5/10	WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27385	high	7.1/10	WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27384	critical	9.0/10	WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27383	high	8.1/10	WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27382	high	7.1/10	WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27381	high	8.1/10	WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27379	high	8.8/10	WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27376	high	7.1/10	WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27375	high	7.1/10	WordPress Gecko theme <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27374	high	7.5/10	WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerability	Mar 5, 2026 5mo ago