WO
Vendor
WordPress
440
CVEs
7
On KEV
1
New 30D
Products
WO9.8
WordPress
CMS
369 CVEs7 on KEV1 new
WM–
Wordpress MU
Wordpress
10 CVEs0 on KEV0 new
SP–
Sniplets Plugin
Wordpress
3 CVEs0 on KEV0 new
BL–
Blix
Wordpress
2 CVEs0 on KEV0 new
MC–
Math Comment Spam Protection Plugin
Wordpress
2 CVEs0 on KEV0 new
PA–
Pay-with-tweet
Wordpress
2 CVEs0 on KEV0 new
WP–
Wassup Plugin
Wordpress
2 CVEs0 on KEV0 new
AD–
Adserve
Wordpress
1 CVEs0 on KEV0 new
AB–
Alert Before You Post
Wordpress
1 CVEs0 on KEV0 new
BL–
Blixed
Wordpress
1 CVEs0 on KEV0 new
BL–
Blixkrieg
Wordpress
1 CVEs0 on KEV0 new
BI8.8
Blogger Importer
Wordpress
1 CVEs0 on KEV0 new
CA–
Captcha
Wordpress
1 CVEs0 on KEV0 new
CR–
Cryptographp
Wordpress
1 CVEs0 on KEV0 new
DL–
Dean Logan Wp-people Plugin
Wordpress
1 CVEs0 on KEV0 new
DB6.1
Debug Bar
Wordpress
1 CVEs0 on KEV0 new
DM–
Download Monitor Plugin
Wordpress
1 CVEs0 on KEV0 new
ED8.8
External Database Based Actions
Wordpress
1 CVEs0 on KEV0 new
FW–
Fcchat Widget
Wordpress
1 CVEs0 on KEV0 new
FI–
Filemanager
Wordpress
1 CVEs0 on KEV0 new
GC5.3
Geo Controller
Wordpress
1 CVEs0 on KEV0 new
GU5.4
Gutenberg
Wordpress
1 CVEs0 on KEV0 new
HC8.8
Health Check & Troubleshooting
Wordpress
1 CVEs0 on KEV0 new
LS–
Lanoba Social Plugin
Wordpress
1 CVEs0 on KEV0 new
LW8.1
Login With Otp Plugin
Wordpress
1 CVEs0 on KEV0 new
NR6.5
Nate Reist Protected Posts Logout Button
Wordpress
1 CVEs0 on KEV0 new
PF–
Page Flip Image Gallery Plugin
Wordpress
1 CVEs0 on KEV0 new
PL8.8
Performance Lab
Wordpress
1 CVEs0 on KEV0 new
PM–
Permalinks Migration Plugin
Wordpress
1 CVEs0 on KEV0 new
PM–
Peter's Math Anti-spam For Wordpress
Wordpress
1 CVEs0 on KEV0 new
PA–
Photo Album Plugin
Wordpress
1 CVEs0 on KEV0 new
PI–
Pictpress
Wordpress
1 CVEs0 on KEV0 new
PN–
Plugin Newsletter Plugin
Wordpress
1 CVEs0 on KEV0 new
PO–
Pool
Wordpress
1 CVEs0 on KEV0 new
RE9.8
Requests
Wordpress
1 CVEs0 on KEV0 new
SU–
Search Unleashed Plugin
Wordpress
1 CVEs0 on KEV0 new
SI–
Sirius
Wordpress
1 CVEs0 on KEV0 new
SG–
Slideshow Gallery2
Wordpress
1 CVEs0 on KEV0 new
SP–
Spambam Plugin
Wordpress
1 CVEs0 on KEV0 new
SN–
ST Newsletter Plugin
Wordpress
1 CVEs0 on KEV0 new
TT7.2
Thanh Toan Quet MA QR Code TU Dong
Wordpress
1 CVEs0 on KEV0 new
UT–
Unamed Theme
Wordpress
1 CVEs0 on KEV0 new
UT–
Unamed Theme SE
Wordpress
1 CVEs0 on KEV0 new
UF–
Upload File Plugin
Wordpress
1 CVEs0 on KEV0 new
WO7.2
Woocommerce Order Proposal
Wordpress
1 CVEs0 on KEV0 new
WO–
Wordpress-users
Wordpress
1 CVEs0 on KEV0 new
WO–
Wordpressclassic
Wordpress
1 CVEs0 on KEV0 new
WO–
Wordspew
Wordpress
1 CVEs0 on KEV0 new
WC–
WP Cal Plugin
Wordpress
1 CVEs0 on KEV0 new
WP–
Wp-contactform
Wordpress
1 CVEs0 on KEV0 new
WD–
WP Download
Wordpress
1 CVEs0 on KEV0 new
WD–
WP Downloads Manager
Wordpress
1 CVEs0 on KEV0 new
WP–
Wp-footnotes
Wordpress
1 CVEs0 on KEV0 new
WF–
WP Forum
Wordpress
1 CVEs0 on KEV0 new
WM–
WP Maintenance Mode Plugin
Wordpress
1 CVEs0 on KEV0 new
WP5.3
WP Private Content Plus Plugin
Wordpress
1 CVEs0 on KEV0 new
WP–
Wpss
Wordpress
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114570 | WO WordPress WordPress | 4.9 | Oct 22 | WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit |
| CVE-2026-87902 In wildKEV | WO WordPress WordPress | 8.1 | Sep 22 | WordPress Core Remote File Inclusion Vulnerability |
| CVE-2026-65640 | WO WordPress WordPress | 8.8 | Aug 17 | WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher |
| CVE-2026-64638 | WO WordPress WordPress | 8.9 | Aug 7 | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen |
| CVE-2026-45293 | WO WordPress WordPress | 8.6 | Jul 28 | WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability |
| CVE-2026-63030 In wildKEV | WO WordPress WordPress | 9.8 | Jul 17 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution |
| CVE-2026-60137 In wildKEV | WO WordPress WordPress | 5.9 | Jul 17 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query |
| CVE-2020-37233 | WO WordPress WordPress | 6.4 | May 16 | WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting |
| CVE-2026-3906 | WO WordPress WordPress | 4.3 | Mar 11 | WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API |
| CVE-2023-54333 | WO WordPress WordPress | 8.2 | Jan 13 | Social-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter |
| CVE-2025-58674 | WO WordPress WordPress | 5.9 | Sep 23 | WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-58246 | WO WordPress WordPress | 4.3 | Sep 23 | WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability |
| CVE-2025-54352 | WO WordPress WordPress | 3.7 | Jul 21 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests |
| CVE-2023-25454 | NR Nate Reist Protected Posts Logout Button Wordpress | 6.5 | Dec 9 | WordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerability |
| CVE-2024-11292 | WP WP Private Content Plus Plugin Wordpress | 5.3 | Dec 6 | WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure |
| CVE-2024-11178 | LW Login With Otp Plugin Wordpress | 8.1 | Dec 6 | Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP |
| CVE-2024-10311 | ED External Database Based Actions Wordpress | 8.8 | Nov 15 | External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass |
| CVE-2024-9927 | WO Woocommerce Order Proposal Wordpress | 7.2 | Oct 23 | WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal |
| CVE-2022-4973 | WO WordPress WordPress | 5.4 | Oct 16 | WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function |
| CVE-2024-8914 | TT Thanh Toan Quet MA QR Code TU Dong Wordpress | 7.2 | Sep 25 | The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to,… |
| CVE-2024-7381 | GC Geo Controller Wordpress | 5.3 | Sep 5 | Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution |
| CVE-2024-4439 | WO WordPress WordPress | 6.1 | May 3 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the… |
| CVE-2024-31211 | WO WordPress WordPress | 9.8 | Apr 4 | WordPress is an open publishing platform for the Web |
| CVE-2024-31210 | WO WordPress WordPress | 8.8 | Apr 4 | WordPress is an open publishing platform for the Web |
| CVE-2023-5561 | WO WordPress WordPress | 5.3 | Oct 16 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have… |
| CVE-2023-39999 | WO WordPress WordPress | 4.3 | Oct 13 | WordPress < 6.3.2 is vulnerable to Broken Access Control |
| CVE-2023-38000 | WO WordPress WordPress | 5.4 | Oct 13 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5,… |
| CVE-2013-10027 | BI Blogger Importer Wordpress | 8.8 | Jun 4 | A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress |
| CVE-2022-47174 | PL Performance Lab Wordpress | 8.8 | May 25 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions |
| CVE-2022-47161 | HC Health Check & Troubleshooting Wordpress | 8.8 | May 25 | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions |
| CVE-2023-2745 | WO WordPress WordPress | 5.4 | May 17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter |
| CVE-2013-10021 | DB Debug Bar Wordpress | 6.1 | Mar 11 | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress |
| CVE-2023-22622 | WO WordPress WordPress | 5.3 | Jan 5 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where… |
| CVE-2022-3590 | WO WordPress WordPress | 5.9 | Dec 14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature |
| CVE-2022-43504 | WO WordPress WordPress | 5.3 | Dec 5 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using… |
| CVE-2022-43500 | WO WordPress WordPress | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script |
| CVE-2022-43497 | WO WordPress WordPress | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script |
| CVE-2011-1762 | WO WordPress WordPress | 6.5 | Apr 18 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts |
| CVE-2022-21664 | WO WordPress WordPress | 8.8 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2022-21663 | WO WordPress WordPress | 7.2 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2022-21662 | WO WordPress WordPress | 5.4 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2022-21661 | WO WordPress WordPress | 7.5 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2021-44223 | WO WordPress WordPress | 9.8 | Nov 25 | WordPress before 5.8 lacks support for the Update URI plugin header |
| CVE-2021-39203 | WO WordPress WordPress | 6.5 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2021-39202 | WO WordPress WordPress | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2021-39201 | WO WordPress WordPress | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2021-39200 | WO WordPress WordPress | 5.3 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2020-36326 | WO WordPress WordPress | 9.8 | Apr 28 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname |
| CVE-2021-29476 | RE Requests Wordpress | 9.8 | Apr 27 | Requests is a HTTP library written in PHP |
| CVE-2021-29450 | WO WordPress WordPress | 4.3 | Apr 15 | Wordpress is an open source CMS |
| CVE-2021-29447 | WO WordPress WordPress | 6.5 | Apr 15 | Wordpress is an open source CMS |
| CVE-2020-28040 | WO WordPress WordPress | 4.3 | Nov 2 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image |
| CVE-2020-28039 | WO WordPress WordPress | 9.1 | Nov 2 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered… |
| CVE-2020-28038 | WO WordPress WordPress | 6.1 | Nov 2 | WordPress before 5.5.2 allows stored XSS via post slugs |
| CVE-2020-28037 | WO WordPress WordPress | 9.8 | Nov 2 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a… |
| CVE-2020-28036 | WO WordPress WordPress | 9.8 | Nov 2 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post |
| CVE-2020-28035 | WO WordPress WordPress | 9.8 | Nov 2 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC |
| CVE-2020-28034 | WO WordPress WordPress | 6.1 | Nov 2 | WordPress before 5.5.2 allows XSS associated with global variables |
| CVE-2020-28033 | WO WordPress WordPress | 7.5 | Nov 2 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed |
| CVE-2020-28032 | WO WordPress WordPress | 9.8 | Nov 2 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php |