Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

342,993

All time

Critical · Active

11,210

CVSS ≥ 9.0

New · 14 days

3,019

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17011–17040 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-24381	medium	5.9/10	WordPress Advanced Social Pixel Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)	Mar 20, 2023 3y ago
CVE-2023-25064	medium	5.9/10	WordPress WP htpasswd Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)	Mar 20, 2023 3y ago
CVE-2023-25794	medium	5.9/10	WordPress Nooz Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)	Mar 20, 2023 3y ago
CVE-2023-25795	medium	5.9/10	WordPress Feed Changer Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)	Mar 20, 2023 3y ago
CVE-2023-25782	medium	5.9/10	WordPress Service Area Postcode Checker Plugin <= 2.0.8 is vulnerable to Cross Site Scripting (XSS)	Mar 20, 2023 3y ago
CVE-2022-46867	medium	4.3/10	WordPress Universal Star Rating Plugin <= 2.1.0 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 17, 2023 3y ago
CVE-2022-46854	medium	5.4/10	WordPress Launchpad – Coming Soon & Maintenance Mode Plugin Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 17, 2023 3y ago
CVE-2022-45817	medium	5.4/10	WordPress GC Testimonials Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)	Mar 17, 2023 3y ago
CVE-2022-45814	medium	5.4/10	WordPress WP Calendar Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)	Mar 17, 2023 3y ago
CVE-2022-43461	medium	4.8/10	WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)	Mar 17, 2023 3y ago
CVE-2023-1470	medium	4.4/10	eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting	Mar 17, 2023 3y ago
CVE-2021-36821	high	7.1/10	WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability	Mar 16, 2023 3y ago
CVE-2022-41554	medium	4.8/10	WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)	Mar 16, 2023 3y ago
CVE-2022-40699	medium	5.4/10	WordPress Yet Another Stars Rating Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)	Mar 16, 2023 3y ago
CVE-2022-38971	medium	4.7/10	WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)	Mar 16, 2023 3y ago
CVE-2022-38063	medium	5.4/10	WordPress Social Login WP Plugin <= 5.0.0.0 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 16, 2023 3y ago
CVE-2022-37402	medium	4.8/10	WordPress AFS Analytics Plugin <= 4.18 is vulnerable to Cross Site Scripting (XSS)	Mar 15, 2023 3y ago
CVE-2022-34148	medium	4.8/10	WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)	Mar 15, 2023 3y ago
CVE-2022-38456	medium	4.3/10	WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure	Mar 15, 2023 3y ago
CVE-2022-44580	critical	9.1/10	WordPress Plugin for Google Reviews Plugin <= 2.2.3 is vulnerable to SQL Injection	Mar 15, 2023 3y ago
CVE-2022-47427	medium	5.4/10	WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2023-25708	medium	4.3/10	WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2023-25709	medium	5.4/10	WordPress Locatoraid Store Locator Plugin <= 3.9.11 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2023-25968	medium	4.3/10	WordPress Client Portal – Private user pages and login Plugin <= 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2022-47143	medium	4.3/10	WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47141	medium	5.4/10	WordPress WP Dynamic Keywords Injector Plugin <= 2.3.15 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47422	medium	4.3/10	WordPress WordPress Stripe Donation and Payment Plugin Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47147	medium	5.4/10	WordPress ipBlockList Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47443	medium	4.3/10	WordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47154	medium	4.3/10	WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago