# cve.now: WordPress

The newest entries affecting WordPress (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119977](https://cve.now/CVE-2026-119977.md): WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution (CVSS 8.1, WordPress Foundation WordPress)
- [CVE-2026-114570](https://cve.now/CVE-2026-114570.md): WordPress Core \<= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit (CVSS 4.9, WordPress Foundation WordPress)
- [CVE-2026-110369](https://cve.now/CVE-2026-110369.md): WordPress WordPress Team Members – GS Plugins plugin \<= 2.8.2 - PHP Object Injection vulnerability (CVSS 8.8, WordPress Team Members – GS Plugins)
- [CVE-2026-66666](https://cve.now/CVE-2026-66666.md): WordPress Core \<= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability (CVSS 6.9, Automattic WordPress)
- [CVE-2026-62071](https://cve.now/CVE-2026-62071.md): WordPress WordPress File Upload plugin \<= 5.1.10 - SQL Injection vulnerability (CVSS 9.3, nickboss WordPress File Upload)
- [CVE-2026-97197](https://cve.now/CVE-2026-97197.md): WordPress WordPress Backup & Migration plugin \<= 1.6.0 - Broken Access Control vulnerability (CVSS 7.5, WebToffee WordPress Backup & Migration)
- [CVE-2026-94081](https://cve.now/CVE-2026-94081.md): WordPress WordPress Persistent Login plugin \<= 3.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, lukeseager WordPress Persistent Login)
- [CVE-2026-87902](https://cve.now/CVE-2026-87902.md): An unauthenticated attacker can make \`get\_page\_template()\` page-template resolution include a chosen readable local \`.php\` file outside the (CVSS 8.1, KEV, WordPress)
- [CVE-2026-93485](https://cve.now/CVE-2026-93485.md): WordPress Core \<= 7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Automattic WordPress)
- [CVE-2026-82229](https://cve.now/CVE-2026-82229.md): WordPress WordPress Social Login and Register plugin \<= 7.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, miniOrange WordPress Social Login and Register)
- [CVE-2026-66594](https://cve.now/CVE-2026-66594.md): WordPress WordPress Persistent Login plugin \<= 3.1.0 - SQL Injection vulnerability (CVSS 8.5, lukeseager WordPress Persistent Login)
- [CVE-2026-73351](https://cve.now/CVE-2026-73351.md): WordPress WordPress Social Login and Register plugin \<= 7.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, miniOrange WordPress Social Login and Register)
- [CVE-2026-65640](https://cve.now/CVE-2026-65640.md): WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. (CVSS 8.8, WordPress)
- [CVE-2026-64638](https://cve.now/CVE-2026-64638.md): WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. (CVSS 8.9, WordPress)
- [CVE-2026-66447](https://cve.now/CVE-2026-66447.md): WordPress WordPress File Upload plugin \<= 5.1.7 - SQL Injection vulnerability (CVSS 9.3, nickboss WordPress File Upload)
- [CVE-2026-45293](https://cve.now/CVE-2026-45293.md): WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability (CVSS 8.6, WordPress-Coding-Standards · wp-coding-standards/wpcs)
- [CVE-2026-65561](https://cve.now/CVE-2026-65561.md): WordPress WordPress Social Login and Register plugin \<= 7.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, miniOrange WordPress Social Login and Register)
- [CVE-2026-63030](https://cve.now/CVE-2026-63030.md): WordPress \< 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (CVSS 9.8, KEV, WordPress)
- [CVE-2026-60137](https://cve.now/CVE-2026-60137.md): WordPress \< 7.0.2 - Facilitated SQL Injection via author\_\_not\_in in WP\_Query (CVSS 5.9, KEV, WordPress)
- [CVE-2026-22343](https://cve.now/CVE-2026-22343.md): WordPress WordPress Dating Theme theme \<= 11.2.0 - Broken Access Control vulnerability (CVSS 8.6, PremiumPress Limited. WordPress Dating Theme)
- [CVE-2026-22342](https://cve.now/CVE-2026-22342.md): WordPress WordPress Dating Theme theme \<= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability (CVSS 8.8, PremiumPress Limited. WordPress Dating Theme)
- [CVE-2025-69129](https://cve.now/CVE-2025-69129.md): WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin \<= 1.0.7 - Arbitrary File Upload vulnerability (CVSS 10.0, Extendons WordPress & WooCommerce Scraper Plugin, Import Da…)
- [CVE-2025-69131](https://cve.now/CVE-2025-69131.md): WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin \<= 1.0.7 - Arbitrary File Download vulnerability (CVSS 7.5, extendons WordPress & WooCommerce Scraper Plugin, Import Da…)
- [CVE-2026-47365](https://cve.now/CVE-2026-47365.md): Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cro (CVSS 9.9, WebPros WordPress-Toolkit)
- [CVE-2020-37233](https://cve.now/CVE-2020-37233.md): WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting (CVSS 5.1, Wordpress Buddypress)
- [CVE-2022-50970](https://cve.now/CVE-2022-50970.md): WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter (CVSS 5.1, Getaawp WordPress Plugin AAWP)
- [CVE-2023-54346](https://cve.now/CVE-2023-54346.md): WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download (CVSS 8.7, Backupbliss WordPress Plugin Backup Migration)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1, sebet Go Fetch Jobs · 5starplugins Dynamic Copyright Y… +129)
- [CVE-2023-54359](https://cve.now/CVE-2023-54359.md): WordPress adivaha Travel Plugin 2.3 SQL Injection via pid (CVSS 8.8, WordPress adivaha Travel Plugin)
- [CVE-2023-54358](https://cve.now/CVE-2023-54358.md): WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile (CVSS 5.1, WordPress adivaha Travel Plugin)
- [CVE-2026-4072](https://cve.now/CVE-2026-4072.md): WordPress PayPal Donation \<= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute (CVSS 6.4, tstachl WordPress PayPal Donation)
- [CVE-2026-3906](https://cve.now/CVE-2026-3906.md): WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API (CVSS 4.3, WordPress Foundation WordPress)
- [CVE-2026-22459](https://cve.now/CVE-2026-22459.md): WordPress WordPress CTA plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 6.5, Blend Media WordPress CTA)
- [CVE-2026-22359](https://cve.now/CVE-2026-22359.md): WordPress Wordpress Movies Bulk Importer plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AA-Team Wordpress Movies Bulk Importer)
- [CVE-2025-53240](https://cve.now/CVE-2025-53240.md): WordPress WordPress Photo Gallery plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, adamlabs WordPress Photo Gallery)
- [CVE-2023-54333](https://cve.now/CVE-2023-54333.md): Social-Share-Buttons 2.2.3 - SQL Injection via project\_id Parameter (CVSS 8.8, Wordpress Social-Share-Buttons)
- [CVE-2025-9427](https://cve.now/CVE-2025-9427.md): Admin reflected XSS (CVSS 8.4, Lemonsoft WordPress add-on)
- [CVE-2025-62088](https://cve.now/CVE-2025-62088.md): WordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin \<= 1.0.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, extendons WordPress & WooCommerce Scraper Plugin, Import Da…)
- [CVE-2025-63005](https://cve.now/CVE-2025-63005.md): WordPress WordPress Tooltips plugin \<= 10.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tomas WordPress Tooltips)
- [CVE-2025-68974](https://cve.now/CVE-2025-68974.md): WordPress WordPress Social Login and Register plugin \<= 7.7.0 - Local File Inclusion vulnerability (CVSS 6.6, miniOrange WordPress Social Login and Register)
- [CVE-2025-68893](https://cve.now/CVE-2025-68893.md): WordPress WordPress Image shrinker plugin \<= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, HETWORKS WordPress Image shrinker)
- [CVE-2025-64231](https://cve.now/CVE-2025-64231.md): WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin \<= 3.0.0 - Arbitrary File Upload vulnerability (CVSS 9.9, RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet…)
- [CVE-2024-14015](https://cve.now/CVE-2024-14015.md): Studiocart \<= 2.9.0 - Reflected XSS (CVSS 7.1, WordPress eCommerce Plugin)
- [CVE-2025-11769](https://cve.now/CVE-2025-11769.md): WordPress Content Flipper \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, aumsrini WordPress Content Flipper)
- [CVE-2025-7846](https://cve.now/CVE-2025-7846.md): WordPress User Extra Fields \<= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save\_fields Function (CVSS 8.8, vanquish WordPress User Extra Fields)
- [CVE-2025-4665](https://cve.now/CVE-2025-4665.md): WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that (CVSS 9.6, WordPress Contact Form 7 Database Addon CFDB7 By Arshid CFD…)
- [CVE-2025-10129](https://cve.now/CVE-2025-10129.md): WordPress Live Webcam Widget & Shortcode \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, miksco WordPress Live Webcam Widget & Shortcode)
- [CVE-2025-58674](https://cve.now/CVE-2025-58674.md): WordPress \<= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, WordPress)
- [CVE-2025-58246](https://cve.now/CVE-2025-58246.md): WordPress \<= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability (CVSS 4.3, WordPress)
- [CVE-2025-57989](https://cve.now/CVE-2025-57989.md): WordPress WordPress Widgets Shortcode Plugin \<= 1.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Brajesh Singh WordPress Widgets Shortcode)
- [CVE-2025-53307](https://cve.now/CVE-2025-53307.md): WordPress Assistant Plugin \<= 1.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Beaver Builder WordPress Assistant)
- [CVE-2025-58862](https://cve.now/CVE-2025-58862.md): WordPress WordPress Events Calendar Plugin – connectDaily Plugin \<= 1.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, George Sexton WordPress Events Calendar Plugin – connectDai…)
- [CVE-2025-58846](https://cve.now/CVE-2025-58846.md): WordPress WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule Plugin \<= 2020.1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Dejan Markovic WordPress Buffer – HYPESocial. Social Media…)
- [CVE-2025-58806](https://cve.now/CVE-2025-58806.md): WordPress WordPress Error Monitoring by Bugsnag Plugin \<= 1.6.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Tom Longridge WordPress Error Monitoring by Bugsnag)
- [CVE-2025-9990](https://cve.now/CVE-2025-9990.md): WordPress Helpdesk Integration \<= 5.8.10 - Unauthenticated Local File Inclusion (CVSS 8.1, smackcoders WordPress Helpdesk Integration)
- [CVE-2025-48315](https://cve.now/CVE-2025-48315.md): WordPress WordPress HTML plugin \<= 0.51 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, stanton119 WordPress HTML)
- [CVE-2025-6247](https://cve.now/CVE-2025-6247.md): WordPress Automatic Plugin - AI content generator and auto poster plugin \<= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 4.7, ValvePress WordPress Automatic Plugin)
- [CVE-2025-52730](https://cve.now/CVE-2025-52730.md): WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin \<= 4.0.24 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, themefunction WordPress Event Manager, Event Calendar and B…)
- [CVE-2025-52731](https://cve.now/CVE-2025-52731.md): WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin \<= 4.0.24 - Arbitrary Content Deletion Vulnerability (CVSS 7.5, themefunction WordPress Event Manager, Event Calendar and B…)
- [CVE-2012-10027](https://cve.now/CVE-2012-10027.md): WordPress Plugin WP-Property \<= 1.35.0 PHP File Upload (CVSS 9.3, WP-Property WordPress Plugin)
- [CVE-2012-10025](https://cve.now/CVE-2012-10025.md): WordPress Plugin Advanced Custom Fields \<= 3.5.1 Remote File Inclusion (CVSS 10.0, Advanced Custom Fields WordPress Plugin)
- [CVE-2025-54352](https://cve.now/CVE-2025-54352.md): WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. (CVSS 3.7, WordPress)
- [CVE-2025-46500](https://cve.now/CVE-2025-46500.md): WordPress Wordpress Auto Spinner plugin \<= 3.26.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ValvePress Wordpress Auto Spinner)
- [CVE-2025-34077](https://cve.now/CVE-2025-34077.md): WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE (CVSS 10.0, Genetech Solutions WordPress Pie Register Plugin)
- [CVE-2025-53270](https://cve.now/CVE-2025-53270.md): WordPress CTA plugin \<= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Blend Media WordPress CTA)
- [CVE-2025-6003](https://cve.now/CVE-2025-6003.md): WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure (CVSS 5.3, cyberlord92 WordPress Single Sign-On (SSO) - Single Site… +5)
- [CVE-2025-5395](https://cve.now/CVE-2025-5395.md): WordPress Automatic Plugin - AI content generator and auto poster plugin \<= 3.115.0 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, ValvePress WordPress Automatic Plugin)
- [CVE-2025-49455](https://cve.now/CVE-2025-49455.md): WordPress WordPress-WPJobBoard \<= 25.07010000-WP6.8.1-JB5.11.5 - SQL Injection Vulnerability (CVSS 9.3, ClickandPledge WordPress-WPJobBoard)
- [CVE-2025-32305](https://cve.now/CVE-2025-32305.md): WordPress FlatNews theme \<= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sneeit WordPress FlatNews Theme)
- [CVE-2025-5586](https://cve.now/CVE-2025-5586.md): WordPress Ajax Load More and Infinite Scroll \<= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, tushargohel WordPress Ajax Load More and Infinite Scroll)
- [CVE-2025-47670](https://cve.now/CVE-2025-47670.md): WordPress Social Login and Register plugin \<= 7.6.10 - Local File Inclusion Vulnerability (CVSS 8.1, miniOrange WordPress Social Login and Register)
- [CVE-2025-39372](https://cve.now/CVE-2025-39372.md): WordPress WordPress Events Calendar Registration & Tickets plugin \<= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, elbisnero WordPress Events Calendar Registration & Tickets)
- [CVE-2025-39409](https://cve.now/CVE-2025-39409.md): WordPress WordPress Video Robot - The Ultimate Video Importer plugin \<= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pressaholic WordPress Video Robot - The Ultimate Video Impo…)
- [CVE-2025-47581](https://cve.now/CVE-2025-47581.md): WordPress WordPress Events Calendar Registration & Tickets plugin \<= 2.6.0 - PHP Object Injection vulnerability (CVSS 9.8, elbisnero WordPress Events Calendar Registration & Tickets)
- [CVE-2025-47534](https://cve.now/CVE-2025-47534.md): WordPress Wordpress Auto Spinner plugin \<= 3.25.0 - Broken Access Control Vulnerability (CVSS 4.3, ValvePress Wordpress Auto Spinner)
- [CVE-2025-2158](https://cve.now/CVE-2025-2158.md): WordPress Review Plugin: The Ultimate Solution for Building a Review Website \<= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields (CVSS 8.8, mythemeshop WordPress Review Plugin: The Ultimate Solution…)
- [CVE-2025-0627](https://cve.now/CVE-2025-0627.md): AI Autotagger \< 3.30.0 - Admin+ Stored XSS (CVSS 3.5, WordPress Tag, Category, and Taxonomy Manager)
- [CVE-2021-4455](https://cve.now/CVE-2021-4455.md): Wordpress Plugin Smart Product Review \<= 1.0.4 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Codeflist Wordpress Plugin Smart Product Review)
- [CVE-2025-23906](https://cve.now/CVE-2025-23906.md): WordPress WordPress Dashboard Tweeter plugin \<= 1.3.2 - Settings Change vulnerability (CVSS 6.5, wpseek WordPress Dashboard Tweeter)
- [CVE-2025-24651](https://cve.now/CVE-2025-24651.md): WordPress WebToffee WP Backup and Migration plugin \<= 1.5.3 - Sensitive Data Exposure vulnerability (CVSS 5.9, WebToffee WordPress Backup & Migration)
- [CVE-2025-27291](https://cve.now/CVE-2025-27291.md): WordPress Photo Gallery – Image Gallery Plugin \<= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, uxgallery WordPress Photo Gallery – Image Gallery)
- [CVE-2025-32520](https://cve.now/CVE-2025-32520.md): WordPress WordPress Health and Server Condition plugin \<= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, M. Ali Saleem WordPress Health and Server Condition – Integ…)
- [CVE-2025-39545](https://cve.now/CVE-2025-39545.md): WordPress REST API Authentication plugin \<= 3.6.3 - Settings Change Vulnerability (CVSS 5.4, miniOrange WordPress REST API Authentication)
- [CVE-2025-31015](https://cve.now/CVE-2025-31015.md): WordPress SMTP Service, Email Delivery Solved! — MailHawk plugin \<= 1.3.1 - Local File Inclusion Vulnerability (CVSS 7.5, Adrian Tobey WordPress SMTP Service, Email Delivery Solved!…)
- [CVE-2025-32114](https://cve.now/CVE-2025-32114.md): WordPress 5sterrenspecialist plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress 5sterrenspecialist Plugin)
- [CVE-2025-32581](https://cve.now/CVE-2025-32581.md): WordPress WordPress Spam Blocker Plugin \<= 2.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ankit Singla WordPress Spam Blocker)
- [CVE-2025-32597](https://cve.now/CVE-2025-32597.md): WordPress WordPress Events Calendar Plugin – connectDaily plugin \<= 1.5.4 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, George Sexton WordPress Events Calendar Plugin – connectDai…)
- [CVE-2025-31441](https://cve.now/CVE-2025-31441.md): WordPress WordPress Galleria plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress Galleria)
- [CVE-2025-31569](https://cve.now/CVE-2025-31569.md): WordPress wordpress related Posts with thumbnails plugin \<= 3.0.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, wp-buy wordpress related Posts with thumbnails)
- [CVE-2024-13889](https://cve.now/CVE-2024-13889.md): WordPress Importer \<= 0.8.3 - Authenticated (Administrator+) PHP Object Injection (CVSS 7.2, wordpressdotorg WordPress Importer)
- [CVE-2024-10554](https://cve.now/CVE-2024-10554.md): WP-Advanced-Search \< 3.3.9.3 - Admin+ Stored XSS (CVSS 3.5, WordPress WP-Advanced-Search)
- [CVE-2025-30608](https://cve.now/CVE-2025-30608.md): WordPress SQL Backup plugin \<= 3.5.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Anthony WordPress SQL Backup)
- [CVE-2025-30552](https://cve.now/CVE-2025-30552.md): WordPress WordPress Admin Bar Improved plugin \<= 3.3.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Donald Gilbert WordPress Admin Bar Improved)
- [CVE-2025-1530](https://cve.now/CVE-2025-1530.md): Tripetto \<= 8.0.9 - Cross-Site Request Forgery to Arbitrary Results Deletion (CVSS 4.3, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2024-13497](https://cve.now/CVE-2024-13497.md): WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto \<= 8.0.9 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2025-28914](https://cve.now/CVE-2025-28914.md): WordPress wordpress login form to anywhere plugin \<= 0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ajay Sharma wordpress login form to anywhere)
- [CVE-2024-13668](https://cve.now/CVE-2024-13668.md): WordPress Activity O Meter \<= 1 - Reflected XSS (CVSS 7.1, WordPress Activity O Meter)
- [CVE-2024-13232](https://cve.now/CVE-2024-13232.md): WordPress Awesome Import & Export Plugin - Import & Export WordPress Data \<= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation (CVSS 8.8, ddeveloper WordPress Awesome Import & Export Plugin - Impor…)
- [CVE-2025-26885](https://cve.now/CVE-2025-26885.md): WordPress Assistant Plugin \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 7.2, Beaver Builder WordPress Assistant)
- [CVE-2025-1757](https://cve.now/CVE-2025-1757.md): WordPress Portfolio Builder – Portfolio Gallery \<= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, portfoliohub WordPress Portfolio Builder – Portfolio Gallery)
- [CVE-2024-13231](https://cve.now/CVE-2024-13231.md): WordPress Portfolio Builder – Portfolio Gallery \<= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update (CVSS 5.3, portfoliohub WordPress Portfolio Builder – Portfolio Gallery)
- [CVE-2025-23657](https://cve.now/CVE-2025-23657.md): WordPress WordPress-to-candidate for Salesforce CRM plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RusAlex WordPress-to-candidate for Salesforce CRM)
- [CVE-2025-23492](https://cve.now/CVE-2025-23492.md): WordPress 淘宝客插件 plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CantonBolo WordPress 淘宝客插件)
- [CVE-2024-13829](https://cve.now/CVE-2024-13829.md): WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto \<= 8.0.8 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2025-22704](https://cve.now/CVE-2025-22704.md): WordPress Signature plugin \<= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Abinav Thakuri WordPress Signature)
- [CVE-2025-23614](https://cve.now/CVE-2025-23614.md): WordPress WordPress Additional Logins plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, niksudan WordPress Additional Logins)
- [CVE-2024-13098](https://cve.now/CVE-2024-13098.md): WP Email Newsletter \<= 1.1 - Reflected XSS (CVSS 5.4, WordPress Email Newsletter)
- [CVE-2024-13220](https://cve.now/CVE-2024-13220.md): Google Map Professional \<= 1.0 - Reflected XSS (CVSS 6.1, WordPress Google Map Professional)
- [CVE-2024-13596](https://cve.now/CVE-2024-13596.md): WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress \<= 1.7.5 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, pantherius WordPress Survey & Poll – Quiz, Survey and Poll…)
- [CVE-2024-13458](https://cve.now/CVE-2024-13458.md): WordPress SEO Friendly Accordion FAQ with AI assisted content generation \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, qchantelnotice WordPress SEO Friendly Accordion FAQ with AI…)
- [CVE-2025-23931](https://cve.now/CVE-2025-23931.md): WordPress WordPress Local SEO plugin \<= 2.3 - SQL Injection vulnerability (CVSS 9.3, Oliver Fuhrmann WordPress Local SEO)
- [CVE-2025-23867](https://cve.now/CVE-2025-23867.md): WordPress WordPress File Search Plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, markcoker WordPress File Search)
- [CVE-2025-22735](https://cve.now/CVE-2025-22735.md): WordPress Tag Cloud Plugin - Tag Groups plugin \<= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Steve Burge WordPress Tag Cloud Plugin – Tag Groups)
- [CVE-2025-23961](https://cve.now/CVE-2025-23961.md): WordPress WordPress Graphs & Charts Plugin \<= 2.0.8 - Broken Access Control vulnerability (CVSS 5.4, wptasker WordPress Graphs & Charts)
- [CVE-2025-23912](https://cve.now/CVE-2025-23912.md): WordPress WordPress Custom Sidebar Plugin \<= 2.3 - SQL Injection vulnerability (CVSS 8.5, Philipp Speck WordPress Custom Sidebar)
- [CVE-2025-23913](https://cve.now/CVE-2025-23913.md): WordPress Google Map Professional Plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, pankajpragma WordPress Google Map Professional)
- [CVE-2025-23842](https://cve.now/CVE-2025-23842.md): WordPress WordPress Gallery Plugin plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nilesh Shiragave WordPress Gallery Plugin)
- [CVE-2025-23828](https://cve.now/CVE-2025-23828.md): WordPress WordPress Data Guard \[Website Security\] plugin \<= 8 - CSRF to Stored XSS vulnerability (CVSS 7.1, sindhi WordPress Data Guard)
- [CVE-2025-23510](https://cve.now/CVE-2025-23510.md): WordPress WordPress Logging Service plugin \<= 1.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jan Štětina WordPress Logging Service)
- [CVE-2025-22762](https://cve.now/CVE-2025-22762.md): WordPress Octrace Support Pro plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WordPress HelpDesk & Support Ticket System Plugin – Octrace…)
- [CVE-2025-22295](https://cve.now/CVE-2025-22295.md): WordPress Tripetto plugin \<= 8.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2025-22349](https://cve.now/CVE-2025-22349.md): WordPress WordPress Auction Plugin plugin \<= 3.7 - SQL Injection vulnerability (CVSS 7.6, WP Marka WordPress Auction Plugin)
- [CVE-2024-8857](https://cve.now/CVE-2024-8857.md): WordPress Auction \<= 3.7 - Editor+ Stored XSS (CVSS 4.8, WordPress Auction Plugin)
- [CVE-2024-8855](https://cve.now/CVE-2024-8855.md): WordPress Auction \<= 3.7 - Editor+ SQL Injection (CVSS 9.8, WordPress Auction Plugin)
- [CVE-2024-12528](https://cve.now/CVE-2024-12528.md): WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress \<= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pantherius WordPress Survey & Poll – Quiz, Survey and Poll…)
- [CVE-2024-56022](https://cve.now/CVE-2024-56022.md): WordPress Preloader by WordPress Monsters plugin \<= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Preloader by WordPress Monsters)
- [CVE-2023-46644](https://cve.now/CVE-2023-46644.md): WordPress WordPress CTA plugin \<= 1.5.8 - Broken Access Control vulnerability (CVSS 6.5, WP CTA PRO WordPress CTA)
- [CVE-2023-45636](https://cve.now/CVE-2023-45636.md): WordPress Backup & Migration plugin \<= 1.4.1 - Broken Access Control vulnerability (CVSS 5.4, WebToffee WordPress Backup & Migration)
- [CVE-2024-8968](https://cve.now/CVE-2024-8968.md): MaxButtons \< 9.8.1 - Admin+ Stored XSS via Text Color (CVSS 4.7, WordPress Button Plugin MaxButtons)
- [CVE-2024-10555](https://cve.now/CVE-2024-10555.md): MaxButtons \< 9.8.1 - Admin+ Stored XSS via Button Width (CVSS 4.8, WordPress Button Plugin MaxButtons)
- [CVE-2024-54391](https://cve.now/CVE-2024-54391.md): WordPress WordPress Filter plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, mattwalters WordPress Filter)
- [CVE-2024-54274](https://cve.now/CVE-2024-54274.md): WordPress Octrace Support plugin \<= 1.2.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress HelpDesk & Support Ticket System Plugin – Octrace…)
- [CVE-2023-33928](https://cve.now/CVE-2023-33928.md): WordPress WordPress Backup & Migration plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3, WebToffee WordPress Backup & Migration)
- [CVE-2023-24375](https://cve.now/CVE-2023-24375.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin \<= 7.5.14 - Broken Access Control vulnerability (CVSS 3.5, miniOrange WordPress Social Login and Register)
- [CVE-2023-25455](https://cve.now/CVE-2023-25455.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin \<= 7.6.0 - Arbitrary Content Deletion vulnerability (CVSS 5.3, miniOrange WordPress Social Login and Register)
- [CVE-2023-28168](https://cve.now/CVE-2023-28168.md): WordPress WordPress Console plugin \<= 0.3.9 - Broken Access Control vulnerability (CVSS 3.7, Jerod Santo WordPress Console)
- [CVE-2024-54207](https://cve.now/CVE-2024-54207.md): WordPress WordPress Auction Plugin plugin \<= 3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Marka WordPress Auction Plugin)
- [CVE-2024-51615](https://cve.now/CVE-2024-51615.md): WordPress WordPress Auction Plugin plugin \<= 3.7 - SQL Injection vulnerability (CVSS 9.3, WP Marka WordPress Auction Plugin)
- [CVE-2024-53788](https://cve.now/CVE-2024-53788.md): WordPress WordPress Portfolio Builder – Portfolio Gallery plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, portfoliohub WordPress Portfolio Builder – Portfolio Gallery)
- [CVE-2024-10869](https://cve.now/CVE-2024-10869.md): GuardGiant Brute Force Protection \<= 2.2.6 - Reflected Cross-Site Scripting (CVSS 6.1, guardgiant WordPress Brute Force Protection – Stop Brute Fo…)
- [CVE-2024-10388](https://cve.now/CVE-2024-10388.md): WordPress GDPR \<= 2.0.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, welaunch WordPress GDPR)
- [CVE-2024-11069](https://cve.now/CVE-2024-11069.md): WordPress GDPR \<= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion (CVSS 6.5, welaunch WordPress GDPR)
- [CVE-2024-52431](https://cve.now/CVE-2024-52431.md): WordPress WP Video Robot plugin \<= 1.20.0 - SQL Injection vulnerability (CVSS 9.3, Pressaholic WordPress Video Robot - The Ultimate Video Impo…)
- [CVE-2024-9192](https://cve.now/CVE-2024-9192.md): WP Video Robot \<= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update (CVSS 8.8, pressaholic WordPress Video Robot - The Ultimate Video Impo…)
- [CVE-2024-10260](https://cve.now/CVE-2024-10260.md): Tripetto \<= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload (CVSS 7.2, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2024-11150](https://cve.now/CVE-2024-11150.md): WordPress User Extra Fields \<= 16.6 - Unauthenticated Arbitrary File Deletion (CVSS 9.8, vanquish WordPress User Extra Fields)
- [CVE-2024-10800](https://cve.now/CVE-2024-10800.md): WordPress User Extra Fields \<= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, vanquish WordPress User Extra Fields)
- [CVE-2024-10801](https://cve.now/CVE-2024-10801.md): WordPress User Extra Fields \<= 16.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, vanquish WordPress User Extra Fields)
- [CVE-2024-37218](https://cve.now/CVE-2024-37218.md): WordPress Page Builder Sandwich \<= 5.1.0 - Broken Access Control vulnerability (CVSS 4.3, WordPress Page Builder Sandwich Team Page Builder Sandwich…)
- [CVE-2024-39639](https://cve.now/CVE-2024-39639.md): WordPress File Upload plugin \<= 4.24.7 - Broken Access Control + CSRF vulnerability (CVSS 4.3, Nickolas Bossinas WordPress File Upload)
- [CVE-2024-8392](https://cve.now/CVE-2024-8392.md): WordPress Post Grid Layouts with Pagination – Sogrid \<= 1.5.6 - Authenticated (Admin+) Local File Inclusion (CVSS 7.2, delabon WordPress Post Grid Layouts with Pagination – Sogrid)
- [CVE-2024-49627](https://cve.now/CVE-2024-49627.md): WordPress WordPress Image SEO plugin \<= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Noor Alam WordPress Image SEO)
- [CVE-2024-49231](https://cve.now/CVE-2024-49231.md): WordPress WordPress Video plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cyclop WordPress Video)
- [CVE-2024-49302](https://cve.now/CVE-2024-49302.md): WordPress WordPress Portfolio Builder – Portfolio Gallery plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, portfoliohub WordPress Portfolio Builder – Portfolio Gallery)
- [CVE-2024-49258](https://cve.now/CVE-2024-49258.md): WordPress Limb Gallery plugin \<= 1.5.7 - Arbitrary File Download vulnerability (CVSS 6.5, Limbcode WordPress Gallery Plugin – Limb Image Gallery)
- [CVE-2024-49260](https://cve.now/CVE-2024-49260.md): WordPress Limb Gallery plugin \<= 1.5.7 - Arbitrary File Upload vulnerability (CVSS 9.9, Limbcode WordPress Gallery Plugin – Limb Image Gallery)
- [CVE-2020-36839](https://cve.now/CVE-2020-36839.md): WP Lead Plus X \<= 0.99 - Cross-Site Request Forgery (CVSS 8.3, bc2018 WordPress Landing Page – Squeeze Page – Responsive L…)
- [CVE-2022-4973](https://cve.now/CVE-2022-4973.md): WordPress Core \< 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the\_meta(); function (CVSS 4.9, WordPress Foundation WordPress)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3, dashlabsltd YASR – Yet Another Star Rating Plugin for… +614)
- [CVE-2024-9375](https://cve.now/CVE-2024-9375.md): WordPress Captcha Plugin by Captcha Bank \<= 4.0.36 - Reflected Cross-Site Scripting (CVSS 6.1, contact-banker WordPress Captcha Plugin by Captcha Bank)
- [CVE-2024-9289](https://cve.now/CVE-2024-9289.md): WordPress & WooCommerce Affiliate Program \<= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation (CVSS 9.8, RedefiningTheWeb WordPress & WooCommerce Affiliate Program)
- [CVE-2022-4541](https://cve.now/CVE-2022-4541.md): WordPress Visitors \<= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header (CVSS 7.2, nitinmaurya12 WordPress Visitors)
- [CVE-2024-43237](https://cve.now/CVE-2024-43237.md): WordPress Tag Groups plugin \<= 2.0.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Steve Burge WordPress Tag Cloud Plugin – Tag Groups)
- [CVE-2024-6494](https://cve.now/CVE-2024-6494.md): WordPress File Upload \< 4.24.8 - Unauthenticated Stored XSS (CVSS 6.1, WordPress File Upload)
- [CVE-2024-6651](https://cve.now/CVE-2024-6651.md): WordPress File Upload \< 4.24.8 - Reflected XSS (CVSS 6.1, WordPress File Upload)
- [CVE-2024-3238](https://cve.now/CVE-2024-3238.md): WordPress Menu Plugin — Superfly Responsive Menu \<= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.8, looks\_awesome WordPress Menu Plugin — Superfly Responsive M…)
- [CVE-2024-37556](https://cve.now/CVE-2024-37556.md): WordPress WordPress Notification Bar plugin \<= 1.3.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, SeedProd WordPress Notification Bar)
- [CVE-2024-3026](https://cve.now/CVE-2024-3026.md): WordPress Button Plugin MaxButtons \< 9.7.8 - Editor+ Stored XSS (CVSS 5.4, WordPress Button Plugin MaxButtons)
- [CVE-2024-38704](https://cve.now/CVE-2024-38704.md): WordPress Team Manager plugin \<= 2.1.12 - Local File Inclusion vulnerability (CVSS 6.5, DynamicWebLab WordPress Team Manager)
- [CVE-2024-32111](https://cve.now/CVE-2024-32111.md): WordPress core \< 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability (CVSS 5.0, Automattic WordPress)
- [CVE-2024-31111](https://cve.now/CVE-2024-31111.md): WordPress Core \< 6.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic WordPress)
- [CVE-2024-6307](https://cve.now/CVE-2024-6307.md): WordPress Core \< 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API (CVSS 6.4, WordPress Foundation WordPress)
- [CVE-2022-45803](https://cve.now/CVE-2022-45803.md): WordPress Gutenberg Forms plugin \<= 2.2.8.3 - Auth. Broken Access Control vulnerability (CVSS 6.5, Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg…)
- [CVE-2024-5021](https://cve.now/CVE-2024-5021.md): WordPress Picture / Portfolio / Media Gallery \<= 3.0.1 - Unauthenticated Server-Side Request Forgery (CVSS 9.3, nimble3 WordPress Picture / Portfolio / Media Gallery)
- [CVE-2024-3978](https://cve.now/CVE-2024-3978.md): WordPress Jitsi Shortcode \<= 0.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, WordPress Jitsi Shortcode)
- [CVE-2024-3977](https://cve.now/CVE-2024-3977.md): WordPress Jitsi Shortcode \<= 0.1 - Admin+ Stored XSS (CVSS 5.1, WordPress Jitsi Shortcode)
- [CVE-2023-52183](https://cve.now/CVE-2023-52183.md): WordPress WordPress Backup & Migration plugin \<= 1.4.3 - Broken Access Control vulnerability (CVSS 5.4, WebToffee WordPress Backup & Migration)
- [CVE-2024-32818](https://cve.now/CVE-2024-32818.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.3 - Broken Access Control vulnerability (CVSS 4.3, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-4849](https://cve.now/CVE-2024-4849.md): WordPress Automatic \<= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter (CVSS 6.4, ValvePress WordPress Automatic Plugin)
- [CVE-2024-22139](https://cve.now/CVE-2024-22139.md): WordPress WordPress Manutenção plugin \<= 1.0.6 - Bypass vulnerability (CVSS 3.7, Filipe Seabra WordPress Manutenção)
- [CVE-2023-47683](https://cve.now/CVE-2023-47683.md): WordPress Social Login, Social Sharing by miniOrange plugin \<= 7.6.6 - Authenticated Privilege Escalation vulnerability (CVSS 8.0, miniOrange WordPress Social Login and Register)
- [CVE-2024-34434](https://cve.now/CVE-2024-34434.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.3.2 - Arbitrary Shortcode Execution vulnerability (CVSS 6.5, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-4439](https://cve.now/CVE-2024-4439.md): WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due t (CVSS 7.2, WordPress Foundation WordPress)
- [CVE-2024-33696](https://cve.now/CVE-2024-33696.md): WordPress WordPress Ad Widget plugin \<= 2.20.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Broadstreet XPRESS WordPress Ad Widget)
- [CVE-2024-32597](https://cve.now/CVE-2024-32597.md): WordPress WP Smart Import plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Xylus Themes WordPress Importer)
- [CVE-2024-31922](https://cve.now/CVE-2024-31922.md): WordPress Hosting Benchmark tool plugin \<= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Anton Aleksandrov WordPress Hosting Benchmark tool)
- [CVE-2024-31235](https://cve.now/CVE-2024-31235.md): WordPress Comments Import & Export plugin \<= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WebToffee WordPress Comments Import & Export)
- [CVE-2024-31285](https://cve.now/CVE-2024-31285.md): WordPress WordPress Tooltips plugin \<= 9.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, WordPress Tooltips)
- [CVE-2024-31342](https://cve.now/CVE-2024-31342.md): WordPress Gallery Exporter plugin \<= 1.3 - Arbitrary File Download vulnerability (CVSS 6.5, WPcloudgallery WordPress Gallery Exporter)
- [CVE-2024-31254](https://cve.now/CVE-2024-31254.md): WordPress WordPress Backup & Migration plugin \<= 1.4.7 - Sensitive Data Exposure via Log File vulnerability (CVSS 3.7, WebToffee WordPress Backup & Migration)
- [CVE-2023-6385](https://cve.now/CVE-2023-6385.md): WordPress Ping Optimizer \<= 2.35.1.3.0 - Log Clearing via CSRF (CVSS 4.3, WordPress Ping Optimizer)
- [CVE-2023-5692](https://cve.now/CVE-2023-5692.md): WordPress Core \<= 6.4.3 - Sensitive Information Exposure via redirect\_guess\_404\_permalink (CVSS 5.3, WordPress Foundation WordPress)
- [CVE-2024-31211](https://cve.now/CVE-2024-31211.md): Remote Code Execution in \`WP\_HTML\_Token\` (CVSS 5.5, wordpress-develop)
- [CVE-2024-31210](https://cve.now/CVE-2024-31210.md): PHP file upload bypass via Plugin installer (CVSS 7.7, wordpress-develop)
- [CVE-2024-30444](https://cve.now/CVE-2024-30444.md): WordPress WordPress Page Builder – Zion Builder plugin \<= 3.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, zionbuilder.io WordPress Page Builder – Zion Builder)
- [CVE-2024-30478](https://cve.now/CVE-2024-30478.md): WordPress Announcement & Notification Banner – Bulletin plugin \<= 3.8.5 - SQL Injection vulnerability (CVSS 7.6, WordPress Announcement & Notification Banner Plugin – Bulle…)
- [CVE-2024-30457](https://cve.now/CVE-2024-30457.md): WordPress MDTF plugin \<= 1.3.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-30243](https://cve.now/CVE-2024-30243.md): WordPress Tooltips plugin \< 9.4.5 - Auth. SQL Injection vulnerability (CVSS 8.5, Tomas WordPress Tooltips)
- [CVE-2022-45847](https://cve.now/CVE-2022-45847.md): WordPress Countdown Widget plugin \<= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) (CVSS 6.1, WPAssist.me WordPress Countdown Widget)
- [CVE-2024-29763](https://cve.now/CVE-2024-29763.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, realmag777 WordPress Meta Data and Taxonomies Filter)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/wordpress
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.