Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,409

All time

Critical · Active

12,590

CVSS ≥ 9.0

New · 14 days

1,356

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 16141–16170 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-46627	high	7.1/10	WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)	Nov 8, 2023 2y ago
CVE-2023-32298	high	7.1/10	WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)	Nov 8, 2023 2y ago
CVE-2023-46626	high	7.1/10	WordPress FLOWFACT WP Connector Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)	Nov 8, 2023 2y ago
CVE-2023-46621	high	7.1/10	WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)	Nov 8, 2023 2y ago
CVE-2023-46613	medium	6.5/10	WordPress Add to Calendar Button Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)	Nov 8, 2023 2y ago
CVE-2023-28499	—	—	WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)	Nov 7, 2023 2y ago
CVE-2023-32966	medium	5.4/10	WordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Request Forgery (CSRF) leading to Stored XSS	Nov 7, 2023 2y ago
CVE-2022-47181	medium	4.3/10	WordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)	Nov 7, 2023 2y ago
CVE-2023-41798	medium	5.1/10	WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-41616	high	7.6/10	WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-38702	medium	5.8/10	WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-42882	medium	5.8/10	WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-44738	medium	5.8/10	WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-45078	medium	5.9/10	WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-45360	medium	4.7/10	WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-45370	medium	6.1/10	WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-45348	medium	5.8/10	WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-45810	medium	6.1/10	WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-46821	medium	5.8/10	WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-46804	medium	5.8/10	WordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-46803	medium	6.1/10	WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-46809	medium	6.1/10	WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-46801	medium	6.1/10	WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-46802	medium	6.1/10	WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2023-36527	medium	4.7/10	WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-45357	medium	6.1/10	WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2023-22719	medium	4.7/10	WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2023-25983	—	—	WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-47442	medium	5.8/10	WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection	Nov 7, 2023 2y ago
CVE-2022-45350	low	3.0/10	WordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection	Nov 7, 2023 2y ago