WordPress vulnerabilities
The newest vulnerabilities affecting WordPress, up to 200. Subscribe by RSS.
- CVE-2026-114570WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick EditWordPress Foundation WordPress
- CVE-2026-110369WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerabilityWordPress Team Members – GS Plugins
- CVE-2026-66666WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerabilityAutomattic WordPress
- CVE-2026-62071WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerabilitynickboss WordPress File Upload
- CVE-2026-97197WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2026-94081WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilitylukeseager WordPress Persistent Login
- CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the WordPress
- CVE-2026-93485WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerabilityAutomattic WordPress
- CVE-2026-82229WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2026-66594WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerabilitylukeseager WordPress Persistent Login
- CVE-2026-73351WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2026-65640WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.WordPress
- CVE-2026-64638WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.WordPress
- CVE-2026-66447WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerabilitynickboss WordPress File Upload
- CVE-2026-45293WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityWordPress-Coding-Standards · wp-coding-standards/wpcs
- CVE-2026-65561WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionWordPress
- CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryWordPress
- CVE-2026-22343WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerabilityPremiumPress Limited. WordPress Dating Theme
- CVE-2026-22342WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerabilityPremiumPress Limited. WordPress Dating Theme
- CVE-2025-69129WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerabilityExtendons WordPress & WooCommerce Scraper Plugin, Import Da…
- CVE-2025-69131WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Download vulnerabilityextendons WordPress & WooCommerce Scraper Plugin, Import Da…
- CVE-2026-47365Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass croWebPros WordPress-Toolkit
- CVE-2020-37233WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site ScriptingWordpress Buddypress
- CVE-2022-50970WordPress Plugin AAWP 3.16 Reflected XSS via tab ParameterGetaawp WordPress Plugin AAWP
- CVE-2023-54346WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup DownloadBackupbliss WordPress Plugin Backup Migration
- CVE-2024-13362Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parametersebet Go Fetch Jobs · 5starplugins Dynamic Copyright Y… +129
- CVE-2023-54359WordPress adivaha Travel Plugin 2.3 SQL Injection via pidWordPress adivaha Travel Plugin
- CVE-2023-54358WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobileWordPress adivaha Travel Plugin
- CVE-2026-4072WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attributetstachl WordPress PayPal Donation
- CVE-2026-3906WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST APIWordPress Foundation WordPress
- CVE-2026-22459WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerabilityBlend Media WordPress CTA
- CVE-2026-22359WordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilityAA-Team Wordpress Movies Bulk Importer
- CVE-2025-53240WordPress WordPress Photo Gallery plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerabilityadamlabs WordPress Photo Gallery
- CVE-2023-54333Social-Share-Buttons 2.2.3 - SQL Injection via project_id ParameterWordpress Social-Share-Buttons
- CVE-2025-9427Admin reflected XSSLemonsoft WordPress add-on
- CVE-2025-62088WordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin <= 1.0.7 - Server Side Request Forgery (SSRF) vulnerabilityextendons WordPress & WooCommerce Scraper Plugin, Import Da…
- CVE-2025-63005WordPress WordPress Tooltips plugin <= 10.9.3 - Cross Site Scripting (XSS) vulnerabilityTomas WordPress Tooltips
- CVE-2025-68974WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2025-68893WordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerabilityHETWORKS WordPress Image shrinker
- CVE-2025-64231WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerabilityRedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet…
- CVE-2024-14015Studiocart <= 2.9.0 - Reflected XSSWordPress eCommerce Plugin
- CVE-2025-11769WordPress Content Flipper <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingaumsrini WordPress Content Flipper
- CVE-2025-7846WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Functionvanquish WordPress User Extra Fields
- CVE-2025-4665WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability thatWordPress Contact Form 7 Database Addon CFDB7 By Arshid CFD…
- CVE-2025-10129WordPress Live Webcam Widget & Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingmiksco WordPress Live Webcam Widget & Shortcode
- CVE-2025-58674WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) VulnerabilityWordPress
- CVE-2025-58246WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure VulnerabilityWordPress
- CVE-2025-57989WordPress WordPress Widgets Shortcode Plugin <= 1.0.3 - Cross Site Scripting (XSS) VulnerabilityBrajesh Singh WordPress Widgets Shortcode
- CVE-2025-53307WordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityBeaver Builder WordPress Assistant
- CVE-2025-58862WordPress WordPress Events Calendar Plugin – connectDaily Plugin <= 1.5.5 - Cross Site Scripting (XSS) VulnerabilityGeorge Sexton WordPress Events Calendar Plugin – connectDai…
- CVE-2025-58846WordPress WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule Plugin <= 2020.1.0 - Cross Site Request Forgery (CSRF) VulnerabilityDejan Markovic WordPress Buffer – HYPESocial. Social Media…
- CVE-2025-58806WordPress WordPress Error Monitoring by Bugsnag Plugin <= 1.6.3 - Cross Site Request Forgery (CSRF) VulnerabilityTom Longridge WordPress Error Monitoring by Bugsnag
- CVE-2025-9990WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusionsmackcoders WordPress Helpdesk Integration
- CVE-2025-48315WordPress WordPress HTML plugin <= 0.51 - Cross Site Scripting (XSS) vulnerabilitystanton119 WordPress HTML
- CVE-2025-6247WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingValvePress WordPress Automatic Plugin
- CVE-2025-52730WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Cross Site Scripting (XSS) Vulnerabilitythemefunction WordPress Event Manager, Event Calendar and B…
- CVE-2025-52731WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Arbitrary Content Deletion Vulnerabilitythemefunction WordPress Event Manager, Event Calendar and B…
- CVE-2012-10027WordPress Plugin WP-Property <= 1.35.0 PHP File UploadWP-Property WordPress Plugin
- CVE-2012-10025WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File InclusionAdvanced Custom Fields WordPress Plugin
- CVE-2025-54352WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.WordPress
- CVE-2025-46500WordPress Wordpress Auto Spinner plugin <= 3.26.0 - Reflected Cross Site Scripting (XSS) vulnerabilityValvePress Wordpress Auto Spinner
- CVE-2025-34077WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCEGenetech Solutions WordPress Pie Register Plugin
- CVE-2025-53270WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) VulnerabilityBlend Media WordPress CTA
- CVE-2025-6003WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposurecyberlord92 WordPress Single Sign-On (SSO) - Single Site… +5
- CVE-2025-5395WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File UploadValvePress WordPress Automatic Plugin
- CVE-2025-49455WordPress WordPress-WPJobBoard <= 25.07010000-WP6.8.1-JB5.11.5 - SQL Injection VulnerabilityClickandPledge WordPress-WPJobBoard
- CVE-2025-32305WordPress FlatNews theme <= 5.8 - Reflected Cross Site Scripting (XSS) vulnerabilitySneeit WordPress FlatNews Theme
- CVE-2025-5586WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parametertushargohel WordPress Ajax Load More and Infinite Scroll
- CVE-2025-47670WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion VulnerabilityminiOrange WordPress Social Login and Register
- CVE-2025-39372WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityelbisnero WordPress Events Calendar Registration & Tickets
- CVE-2025-39409WordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilitypressaholic WordPress Video Robot - The Ultimate Video Impo…
- CVE-2025-47581WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - PHP Object Injection vulnerabilityelbisnero WordPress Events Calendar Registration & Tickets
- CVE-2025-47534WordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control VulnerabilityValvePress Wordpress Auto Spinner
- CVE-2025-2158WordPress Review Plugin: The Ultimate Solution for Building a Review Website <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fieldsmythemeshop WordPress Review Plugin: The Ultimate Solution…
- CVE-2025-0627AI Autotagger < 3.30.0 - Admin+ Stored XSSWordPress Tag, Category, and Taxonomy Manager
- CVE-2021-4455Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File UploadCodeflist Wordpress Plugin Smart Product Review
- CVE-2025-23906WordPress WordPress Dashboard Tweeter plugin <= 1.3.2 - Settings Change vulnerabilitywpseek WordPress Dashboard Tweeter
- CVE-2025-24651WordPress WebToffee WP Backup and Migration plugin <= 1.5.3 - Sensitive Data Exposure vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2025-27291WordPress Photo Gallery – Image Gallery Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityuxgallery WordPress Photo Gallery – Image Gallery
- CVE-2025-32520WordPress WordPress Health and Server Condition plugin <= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityM. Ali Saleem WordPress Health and Server Condition – Integ…
- CVE-2025-39545WordPress REST API Authentication plugin <= 3.6.3 - Settings Change VulnerabilityminiOrange WordPress REST API Authentication
- CVE-2025-31015WordPress SMTP Service, Email Delivery Solved! — MailHawk plugin <= 1.3.1 - Local File Inclusion VulnerabilityAdrian Tobey WordPress SMTP Service, Email Delivery Solved!…
- CVE-2025-32114WordPress 5sterrenspecialist plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress 5sterrenspecialist Plugin
- CVE-2025-32581WordPress WordPress Spam Blocker Plugin <= 2.0.5 - CSRF to Stored XSS vulnerabilityAnkit Singla WordPress Spam Blocker
- CVE-2025-32597WordPress WordPress Events Calendar Plugin – connectDaily plugin <= 1.5.4 - CSRF to Cross-Site Scripting vulnerabilityGeorge Sexton WordPress Events Calendar Plugin – connectDai…
- CVE-2025-31441WordPress WordPress Galleria plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress Galleria
- CVE-2025-31569WordPress wordpress related Posts with thumbnails plugin <= 3.0.0.1 - CSRF to Stored XSS vulnerabilitywp-buy wordpress related Posts with thumbnails
- CVE-2024-13889WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injectionwordpressdotorg WordPress Importer
- CVE-2024-10554WP-Advanced-Search < 3.3.9.3 - Admin+ Stored XSSWordPress WP-Advanced-Search
- CVE-2025-30608WordPress SQL Backup plugin <= 3.5.2 - Cross Site Request Forgery (CSRF) VulnerabilityAnthony WordPress SQL Backup
- CVE-2025-30552WordPress WordPress Admin Bar Improved plugin <= 3.3.5 - CSRF to Stored XSS vulnerabilityDonald Gilbert WordPress Admin Bar Improved
- CVE-2025-1530Tripetto <= 8.0.9 - Cross-Site Request Forgery to Arbitrary Results DeletionWordPress form builder plugin for contact forms, surveys an…
- CVE-2024-13497WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site ScriptingWordPress form builder plugin for contact forms, surveys an…
- CVE-2025-28914WordPress wordpress login form to anywhere plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilityAjay Sharma wordpress login form to anywhere
- CVE-2024-13668WordPress Activity O Meter <= 1 - Reflected XSSWordPress Activity O Meter
- CVE-2024-13232WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalationddeveloper WordPress Awesome Import & Export Plugin - Impor…
- CVE-2025-26885WordPress Assistant Plugin <= 1.5.1 - PHP Object Injection vulnerabilityBeaver Builder WordPress Assistant
- CVE-2025-1757WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeportfoliohub WordPress Portfolio Builder – Portfolio Gallery
- CVE-2024-13231WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Updateportfoliohub WordPress Portfolio Builder – Portfolio Gallery
- CVE-2025-23657WordPress WordPress-to-candidate for Salesforce CRM plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRusAlex WordPress-to-candidate for Salesforce CRM
- CVE-2025-23492WordPress 淘宝客插件 plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCantonBolo WordPress 淘宝客插件
- CVE-2024-13829WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.8 - Unauthenticated Sensitive Information ExposureWordPress form builder plugin for contact forms, surveys an…
- CVE-2025-22704WordPress Signature plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityAbinav Thakuri WordPress Signature
- CVE-2025-23614WordPress WordPress Additional Logins plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityniksudan WordPress Additional Logins
- CVE-2024-13098WP Email Newsletter <= 1.1 - Reflected XSSWordPress Email Newsletter
- CVE-2024-13220Google Map Professional <= 1.0 - Reflected XSSWordPress Google Map Professional
- CVE-2024-13596WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) SQL Injectionpantherius WordPress Survey & Poll – Quiz, Survey and Poll…
- CVE-2024-13458WordPress SEO Friendly Accordion FAQ with AI assisted content generation <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingqchantelnotice WordPress SEO Friendly Accordion FAQ with AI…
- CVE-2025-23931WordPress WordPress Local SEO plugin <= 2.3 - SQL Injection vulnerabilityOliver Fuhrmann WordPress Local SEO
- CVE-2025-23867WordPress WordPress File Search Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymarkcoker WordPress File Search
- CVE-2025-22735WordPress Tag Cloud Plugin - Tag Groups plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilitySteve Burge WordPress Tag Cloud Plugin – Tag Groups
- CVE-2025-23961WordPress WordPress Graphs & Charts Plugin <= 2.0.8 - Broken Access Control vulnerabilitywptasker WordPress Graphs & Charts
- CVE-2025-23912WordPress WordPress Custom Sidebar Plugin <= 2.3 - SQL Injection vulnerabilityPhilipp Speck WordPress Custom Sidebar
- CVE-2025-23913WordPress Google Map Professional Plugin <= 1.0 - SQL Injection vulnerabilitypankajpragma WordPress Google Map Professional
- CVE-2025-23842WordPress WordPress Gallery Plugin plugin <= 1.4 - CSRF to Stored XSS vulnerabilityNilesh Shiragave WordPress Gallery Plugin
- CVE-2025-23828WordPress WordPress Data Guard [Website Security] plugin <= 8 - CSRF to Stored XSS vulnerabilitysindhi WordPress Data Guard
- CVE-2025-23510WordPress WordPress Logging Service plugin <= 1.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityJan Štětina WordPress Logging Service
- CVE-2025-22762WordPress Octrace Support Pro plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityWordPress HelpDesk & Support Ticket System Plugin – Octrace…
- CVE-2025-22295WordPress Tripetto plugin <= 8.0.6 - Cross Site Scripting (XSS) vulnerabilityWordPress form builder plugin for contact forms, surveys an…
- CVE-2025-22349WordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerabilityWP Marka WordPress Auction Plugin
- CVE-2024-8857WordPress Auction <= 3.7 - Editor+ Stored XSSWordPress Auction Plugin
- CVE-2024-8855WordPress Auction <= 3.7 - Editor+ SQL InjectionWordPress Auction Plugin
- CVE-2024-12528WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingpantherius WordPress Survey & Poll – Quiz, Survey and Poll…
- CVE-2024-56022WordPress Preloader by WordPress Monsters plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityPreloader by WordPress Monsters
- CVE-2023-46644WordPress WordPress CTA plugin <= 1.5.8 - Broken Access Control vulnerabilityWP CTA PRO WordPress CTA
- CVE-2023-45636WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2024-8968MaxButtons < 9.8.1 - Admin+ Stored XSS via Text ColorWordPress Button Plugin MaxButtons
- CVE-2024-10555MaxButtons < 9.8.1 - Admin+ Stored XSS via Button WidthWordPress Button Plugin MaxButtons
- CVE-2024-54391WordPress WordPress Filter plugin <= 1.4.1 - CSRF to Stored XSS vulnerabilitymattwalters WordPress Filter
- CVE-2024-54274WordPress Octrace Support plugin <= 1.2.7 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress HelpDesk & Support Ticket System Plugin – Octrace…
- CVE-2023-33928WordPress WordPress Backup & Migration plugin <= 1.4.0 - Broken Access Control vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2023-24375WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2023-25455WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2023-28168WordPress WordPress Console plugin <= 0.3.9 - Broken Access Control vulnerabilityJerod Santo WordPress Console
- CVE-2024-54207WordPress WordPress Auction Plugin plugin <= 3.7 - Cross Site Scripting (XSS) vulnerabilityWP Marka WordPress Auction Plugin
- CVE-2024-51615WordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerabilityWP Marka WordPress Auction Plugin
- CVE-2024-53788WordPress WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityportfoliohub WordPress Portfolio Builder – Portfolio Gallery
- CVE-2024-10869GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scriptingguardgiant WordPress Brute Force Protection – Stop Brute Fo…
- CVE-2024-10388WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scriptingwelaunch WordPress GDPR
- CVE-2024-11069WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletionwelaunch WordPress GDPR
- CVE-2024-52431WordPress WP Video Robot plugin <= 1.20.0 - SQL Injection vulnerabilityPressaholic WordPress Video Robot - The Ultimate Video Impo…
- CVE-2024-9192WP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Updatepressaholic WordPress Video Robot - The Ultimate Video Impo…
- CVE-2024-10260Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File UploadWordPress form builder plugin for contact forms, surveys an…
- CVE-2024-11150WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletionvanquish WordPress User Extra Fields
- CVE-2024-10800WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationvanquish WordPress User Extra Fields
- CVE-2024-10801WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Uploadvanquish WordPress User Extra Fields
- CVE-2024-37218WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerabilityWordPress Page Builder Sandwich Team Page Builder Sandwich…
- CVE-2024-39639WordPress File Upload plugin <= 4.24.7 - Broken Access Control + CSRF vulnerabilityNickolas Bossinas WordPress File Upload
- CVE-2024-8392WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusiondelabon WordPress Post Grid Layouts with Pagination – Sogrid
- CVE-2024-49627WordPress WordPress Image SEO plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerabilityNoor Alam WordPress Image SEO
- CVE-2024-49231WordPress WordPress Video plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitycyclop WordPress Video
- CVE-2024-49302WordPress WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityportfoliohub WordPress Portfolio Builder – Portfolio Gallery
- CVE-2024-49258WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Download vulnerabilityLimbcode WordPress Gallery Plugin – Limb Image Gallery
- CVE-2024-49260WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Upload vulnerabilityLimbcode WordPress Gallery Plugin – Limb Image Gallery
- CVE-2020-36839WP Lead Plus X <= 0.99 - Cross-Site Request Forgerybc2018 WordPress Landing Page – Squeeze Page – Responsive L…
- CVE-2022-4973WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); functionWordPress Foundation WordPress
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checksdashlabsltd YASR – Yet Another Star Rating Plugin for… +614
- CVE-2024-9375WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scriptingcontact-banker WordPress Captcha Plugin by Captcha Bank
- CVE-2024-9289WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege EscalationRedefiningTheWeb WordPress & WooCommerce Affiliate Program
- CVE-2022-4541WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Headernitinmaurya12 WordPress Visitors
- CVE-2024-43237WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerabilitySteve Burge WordPress Tag Cloud Plugin – Tag Groups
- CVE-2024-6494WordPress File Upload < 4.24.8 - Unauthenticated Stored XSSWordPress File Upload
- CVE-2024-6651WordPress File Upload < 4.24.8 - Reflected XSSWordPress File Upload
- CVE-2024-3238WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletionlooks_awesome WordPress Menu Plugin — Superfly Responsive M…
- CVE-2024-37556WordPress WordPress Notification Bar plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerabilitySeedProd WordPress Notification Bar
- CVE-2024-3026WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSSWordPress Button Plugin MaxButtons
- CVE-2024-38704WordPress Team Manager plugin <= 2.1.12 - Local File Inclusion vulnerabilityDynamicWebLab WordPress Team Manager
- CVE-2024-32111WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerabilityAutomattic WordPress
- CVE-2024-31111WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityAutomattic WordPress
- CVE-2024-6307WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML APIWordPress Foundation WordPress
- CVE-2022-45803WordPress Gutenberg Forms plugin <= 2.2.8.3 - Auth. Broken Access Control vulnerabilityNikolay Strikhar WordPress Form Builder Plugin – Gutenberg…
- CVE-2024-5021WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgerynimble3 WordPress Picture / Portfolio / Media Gallery
- CVE-2024-3978WordPress Jitsi Shortcode <= 0.1 - Contributor+ Stored XSS via ShortcodeWordPress Jitsi Shortcode
- CVE-2024-3977WordPress Jitsi Shortcode <= 0.1 - Admin+ Stored XSSWordPress Jitsi Shortcode
- CVE-2023-52183WordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2024-32818WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Broken Access Control vulnerabilityrealmag777 WordPress Meta Data and Taxonomies Filter
- CVE-2024-4849WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay ParameterValvePress WordPress Automatic Plugin
- CVE-2024-22139WordPress WordPress Manutenção plugin <= 1.0.6 - Bypass vulnerabilityFilipe Seabra WordPress Manutenção
- CVE-2023-47683WordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2024-34434WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.2 - Arbitrary Shortcode Execution vulnerabilityrealmag777 WordPress Meta Data and Taxonomies Filter
- CVE-2024-4439WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due tWordPress Foundation WordPress
- CVE-2024-33696WordPress WordPress Ad Widget plugin <= 2.20.0 - Cross Site Scripting (XSS) vulnerabilityBroadstreet XPRESS WordPress Ad Widget
- CVE-2024-32597WordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityXylus Themes WordPress Importer
- CVE-2024-31922WordPress Hosting Benchmark tool plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerabilityAnton Aleksandrov WordPress Hosting Benchmark tool
- CVE-2024-31235WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerabilityWebToffee WordPress Comments Import & Export
- CVE-2024-31285WordPress WordPress Tooltips plugin <= 9.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityWordPress Tooltips
- CVE-2024-31342WordPress Gallery Exporter plugin <= 1.3 - Arbitrary File Download vulnerabilityWPcloudgallery WordPress Gallery Exporter
- CVE-2024-31254WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2023-6385WordPress Ping Optimizer <= 2.35.1.3.0 - Log Clearing via CSRFWordPress Ping Optimizer
- CVE-2023-5692WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalinkWordPress Foundation WordPress
- CVE-2024-31211Remote Code Execution in `WP_HTML_Token`wordpress-develop
- CVE-2024-31210PHP file upload bypass via Plugin installerwordpress-develop
- CVE-2024-30444WordPress WordPress Page Builder – Zion Builder plugin <= 3.6.9 - Cross Site Scripting (XSS) vulnerabilityzionbuilder.io WordPress Page Builder – Zion Builder
- CVE-2024-30478WordPress Announcement & Notification Banner – Bulletin plugin <= 3.8.5 - SQL Injection vulnerabilityWordPress Announcement & Notification Banner Plugin – Bulle…
- CVE-2024-30457WordPress MDTF plugin <= 1.3.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityrealmag777 WordPress Meta Data and Taxonomies Filter
- CVE-2024-30243WordPress Tooltips plugin < 9.4.5 - Auth. SQL Injection vulnerabilityTomas WordPress Tooltips
- CVE-2022-45847WordPress Countdown Widget plugin <= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)WPAssist.me WordPress Countdown Widget
- CVE-2024-29763WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityrealmag777 WordPress Meta Data and Taxonomies Filter
- CVE-2024-29932WordPress WordPress Meta Data and Taxonomies Filter (MDTF) plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityrealmag777 WordPress Meta Data and Taxonomies Filter