Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,511

All time

Critical · Active

12,231

CVSS ≥ 9.0

New · 14 days

3,113

Newly disclosed

Feed last synced

42 mins ago

Data freshness

Showing 2491–2520 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25428	medium	4.4/10	WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25423	low	3.8/10	WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25422	medium	5.4/10	WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25420	medium	4.3/10	WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25419	medium	4.3/10	WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25418	high	7.6/10	WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25416	medium	4.3/10	WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25415	medium	5.3/10	WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25411	medium	4.3/10	WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25410	medium	4.3/10	WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25409	medium	4.3/10	WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25408	medium	5.3/10	WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25407	medium	4.3/10	WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25404	medium	5.3/10	WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25402	medium	4.3/10	WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25399	medium	4.3/10	WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25395	medium	4.3/10	WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25394	medium	4.3/10	WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25393	medium	4.3/10	WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25392	medium	4.7/10	WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25391	medium	5.4/10	WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25389	medium	5.3/10	WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25388	medium	5.4/10	WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25387	medium	4.3/10	WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25386	medium	5.3/10	WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25385	medium	5.5/10	WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25384	medium	5.3/10	WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25378	high	7.6/10	WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25375	medium	4.3/10	WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-25374	medium	5.3/10	WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago