Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,747

All time

Critical · Active

11,182

CVSS ≥ 9.0

New · 14 days

3,051

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 14941–14970 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-41790	medium	4.3/10	WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41786	medium	5.4/10	WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41695	medium	5.4/10	WordPress Traffic Manager Plugin <= 1.4.5 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41619	medium	5.4/10	WordPress Image Zoom Plugin <= 1.8.8 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-40702	medium	5.4/10	WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-41990	high	7.1/10	WordPress 3D Tag Cloud Plugin <= 3.8 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 17, 2024 2y ago
CVE-2023-34379	medium	5.4/10	WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-40203	medium	6.3/10	WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-38141	medium	4.3/10	WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-36418	medium	6.5/10	WordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken Authentication	Jan 17, 2024 2y ago
CVE-2023-6592	—	—	FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure	Jan 16, 2024 2y ago
CVE-2023-3211	—	—	WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection	Jan 16, 2024 2y ago
CVE-2023-5905	—	—	DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export	Jan 15, 2024 2y ago
CVE-2024-22137	medium	6.5/10	WordPress Constant Contact Forms by MailMunch Plugin <= 2.0.11 is vulnerable to Cross Site Scripting (XSS)	Jan 12, 2024 2y ago
CVE-2024-22142	high	7.1/10	WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)	Jan 12, 2024 2y ago
CVE-2023-6242	medium	6.5/10	EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta	Jan 11, 2024 2y ago
CVE-2023-6244	medium	6.5/10	EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings	Jan 11, 2024 2y ago
CVE-2023-6875	critical	9.8/10	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API	Jan 11, 2024 2y ago
CVE-2023-6684	medium	6.4/10	Ibtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Jan 11, 2024 2y ago
CVE-2023-6520	medium	4.3/10	WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery	Jan 11, 2024 2y ago
CVE-2023-6158	medium	6.5/10	EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta	Jan 10, 2024 2y ago
CVE-2023-6594	medium	4.4/10	WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting	Jan 9, 2024 2y ago
CVE-2022-40696	low	3.7/10	WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure	Jan 8, 2024 2y ago
CVE-2022-36352	medium	6.3/10	WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control	Jan 8, 2024 2y ago
CVE-2022-34344	medium	5.4/10	WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Broken Access Control	Jan 8, 2024 2y ago
CVE-2023-52142	high	7.6/10	WordPress Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 is vulnerable to SQL Injection	Jan 8, 2024 2y ago
CVE-2023-52202	critical	9.1/10	WordPress HTML5 MP3 Player with Folder Feedburner Plugin <= 2.8.0 is vulnerable to PHP Object Injection	Jan 8, 2024 2y ago
CVE-2022-45354	medium	5.3/10	WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure	Jan 8, 2024 2y ago
CVE-2023-51406	medium	5.3/10	WordPress FastDup Plugin <= 2.1.7 is vulnerable to Sensitive Data Exposure	Jan 8, 2024 2y ago
CVE-2023-51408	medium	5.3/10	WordPress WP Optin Wheel Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure	Jan 8, 2024 2y ago