Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

336,981

All time

Critical · Active

10,649

CVSS ≥ 9.0

New · 14 days

1,592

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 2251–2280 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-68857	critical	9.3/10	WordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68849	high	7.1/10	WordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68839	high	7.1/10	WordPress Easy Theme Options plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68838	high	7.1/10	WordPress MemberPress Discord Addon plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68835	high	7.1/10	WordPress Ravpage plugin <= 2.33 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68558	medium	6.5/10	WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68538	high	7.1/10	WordPress Craft \| Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68520	high	7.1/10	WordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68518	high	7.1/10	WordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68510	high	8.1/10	WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68507	medium	6.5/10	WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68073	medium	6.5/10	WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68072	medium	6.5/10	WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68059	high	7.6/10	WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68058	high	7.6/10	WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68057	high	7.6/10	WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68047	high	8.8/10	WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68046	medium	6.5/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68041	high	7.1/10	WordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68039	medium	6.5/10	WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68035	high	7.5/10	WordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68034	critical	9.3/10	WordPress CleverReach® WP plugin <= 1.5.21 - SQL Injection vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68030	high	7.2/10	WordPress Frontis Blocks plugin <= 1.1.5 - Server Side Request Forgery (SSRF) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68027	high	7.3/10	WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68020	medium	6.5/10	WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68019	medium	6.5/10	WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68018	critical	9.4/10	WordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68017	high	7.5/10	WordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68016	medium	6.5/10	WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68015	critical	9.0/10	WordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerability	Jan 22, 2026 5mo ago