Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,038

All time

Critical · Active

11,213

CVSS ≥ 9.0

New · 14 days

3,037

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 17191–17220 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-36905	medium	5.4/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities	Nov 17, 2022 3y ago
CVE-2022-40200	critical	9.9/10	WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability	Nov 17, 2022 3y ago
CVE-2022-38461	medium	5.4/10	WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability	Nov 17, 2022 3y ago
CVE-2022-45071	medium	5.4/10	WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 17, 2022 3y ago
CVE-2022-45072	medium	4.3/10	WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 17, 2022 3y ago
CVE-2022-42460	medium	6.5/10	WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)	Nov 10, 2022 3y ago
CVE-2022-44590	medium	5.4/10	WordPress Simple Video Embedder plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 9, 2022 3y ago
CVE-2022-41978	high	8.8/10	WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability	Nov 9, 2022 3y ago
CVE-2022-43488	medium	5.4/10	WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 9, 2022 3y ago
CVE-2022-32587	medium	5.4/10	WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-44741	medium	6.1/10	WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-32776	medium	4.8/10	WordPress Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 8, 2022 3y ago
CVE-2022-41980	medium	4.8/10	WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability	Nov 8, 2022 3y ago
CVE-2022-42494	low	3.0/10	WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-38137	medium	4.3/10	WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40206	medium	6.3/10	WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability	Nov 8, 2022 3y ago
CVE-2022-41136	medium	6.1/10	WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS	Nov 8, 2022 3y ago
CVE-2022-40205	medium	5.4/10	WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40632	medium	5.4/10	WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40223	medium	5.4/10	WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability	Nov 8, 2022 3y ago
CVE-2022-30545	medium	4.8/10	WordPress 5 Anker Connect plugin <= 1.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40128	medium	4.3/10	WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-43481	medium	5.4/10	WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-43491	medium	5.4/10	WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-25952	medium	4.3/10	WordPress Content Egg plugin <= 5.4.0 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 3, 2022 3y ago
CVE-2021-36906	low	2.7/10	WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities	Nov 3, 2022 3y ago
CVE-2022-44628	medium	5.9/10	WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 3, 2022 3y ago
CVE-2022-44627	medium	5.4/10	WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 3, 2022 3y ago
CVE-2022-36404	medium	5.4/10	WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability	Nov 3, 2022 3y ago
CVE-2022-40131	medium	5.4/10	WordPress Page View Count plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 3, 2022 3y ago