Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,031

All time

Critical · Active

11,212

CVSS ≥ 9.0

New · 14 days

3,032

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17101–17130 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-45808	critical	9.9/10	WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection	Jan 24, 2023 3y ago
CVE-2022-47615	critical	9.3/10	WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion	Jan 24, 2023 3y ago
CVE-2023-22721	medium	6.5/10	WordPress Oi Yandex.Maps for WordPress Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)	Jan 23, 2023 3y ago
CVE-2022-4650	—	—	HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode	Jan 23, 2023 3y ago
CVE-2022-4383	—	—	CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQLi	Jan 23, 2023 3y ago
CVE-2022-4672	—	—	WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via Shortcode	Jan 23, 2023 3y ago
CVE-2022-4832	—	—	Store Locator WordPress < 1.4.9 - Contributor+ Stored XSS via Shortcode	Jan 23, 2023 3y ago
CVE-2022-40697	medium	4.8/10	WordPress 3com – Asesor de Cookies para normativa española Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)	Jan 19, 2023 3y ago
CVE-2022-43462	critical	9.1/10	WordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to SQL Injection (SQLi) vulnerability	Jan 17, 2023 3y ago
CVE-2022-42462	medium	4.8/10	WordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to Cross Site Scripting (XSS)	Jan 17, 2023 3y ago
CVE-2022-30544	medium	4.3/10	WordPress OSM – OpenStreetMap Plugin <= 6.0.1 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 17, 2023 3y ago
CVE-2022-4320	—	—	WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS	Jan 16, 2023 3y ago
CVE-2022-45353	medium	4.3/10	WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control	Jan 14, 2023 3y ago
CVE-2022-38467	medium	6.1/10	WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability	Jan 14, 2023 3y ago
CVE-2022-4391	—	—	Vision Interactive For WordPress <= 1.5.3 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2022-4394	—	—	iPages Flipbook For WordPress <= 1.4.6 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2022-4393	—	—	ImageLinks Interactive Image Builder for WordPress <= 1.5.3 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2022-4392	—	—	iPanorama 360 WordPress Virtual Tour Builder <= 1.6.29 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2023-0038	high	7.2/10	Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting	Jan 3, 2023 3y ago
CVE-2022-4142	—	—	WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS	Jan 2, 2023 3y ago
CVE-2022-44588	critical	9.9/10	WordPress Cryptocurrency Widgets Pack Plugin <=1.8.1 is vulnerable to SQL Injection	Dec 15, 2022 3y ago
CVE-2022-2536	medium	5.3/10	Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass	Dec 15, 2022 3y ago
CVE-2022-42699	critical	9.1/10	WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)	Dec 6, 2022 3y ago
CVE-2022-45829	high	8.7/10	WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion	Dec 6, 2022 3y ago
CVE-2022-45833	medium	6.8/10	WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal	Dec 6, 2022 3y ago
CVE-2022-45816	medium	4.8/10	WordPress GD bbPress Attachments Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)	Dec 6, 2022 3y ago
CVE-2022-45848	medium	6.1/10	WordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS)	Dec 6, 2022 3y ago
CVE-2022-42888	critical	9.8/10	WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation	Dec 6, 2022 3y ago
CVE-2022-45359	critical	9.8/10	WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload	Dec 6, 2022 3y ago
CVE-2022-45824	medium	5.4/10	WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 5, 2022 3y ago