Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

356,134

All time

Critical · Active

12,718

CVSS ≥ 9.0

New · 14 days

2,320

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 2671–2700 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25378	high	7.6/10	WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25375	medium	4.3/10	WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25374	medium	5.3/10	WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25372	medium	6.5/10	WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25370	medium	5.3/10	WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25368	medium	6.5/10	WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25367	medium	5.3/10	WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25364	medium	5.3/10	WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25363	medium	4.3/10	WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25362	medium	5.9/10	WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25348	medium	5.3/10	WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25343	medium	5.9/10	WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25338	medium	5.3/10	WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25337	medium	5.4/10	WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25336	medium	5.3/10	WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25335	medium	4.3/10	WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25333	medium	5.3/10	WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25332	medium	5.3/10	WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25331	medium	6.5/10	WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25330	medium	4.3/10	WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25329	medium	4.3/10	WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25326	high	7.5/10	WordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25325	medium	5.3/10	WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25324	medium	5.3/10	WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25323	medium	4.3/10	WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25322	medium	5.4/10	WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25321	medium	5.3/10	WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25320	medium	5.3/10	WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25319	medium	4.3/10	WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 8mo ago
CVE-2026-25318	medium	4.3/10	WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability	Feb 19, 2026 8mo ago