Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,048

All time

Critical · Active

11,217

CVSS ≥ 9.0

New · 14 days

3,011

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17221–17250 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-36428	medium	4.8/10	WordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerability	Nov 3, 2022 3y ago
CVE-2022-44586	medium	4.8/10	WordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 2, 2022 3y ago
CVE-2022-44576	medium	4.8/10	WordPress AgentEasy Properties plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 2, 2022 3y ago
CVE-2021-36898	high	7.5/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability	Oct 28, 2022 3y ago
CVE-2021-36864	low	3.4/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability	Oct 28, 2022 3y ago
CVE-2021-36863	medium	5.4/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 28, 2022 3y ago
CVE-2021-36858	medium	4.8/10	WordPress Testimonials plugin <= 2.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 28, 2022 3y ago
CVE-2022-41996	high	8.8/10	WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 27, 2022 3y ago
CVE-2022-38104	high	7.2/10	WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability	Oct 21, 2022 3y ago
CVE-2022-40311	medium	4.8/10	WordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Oct 21, 2022 3y ago
CVE-2022-41638	medium	5.4/10	WordPress Pop-Up Chop Chop plugin <= 2.1.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 21, 2022 3y ago
CVE-2022-26375	medium	4.8/10	WordPress AB Press Optimizer plugin <= 1.1.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 17, 2022 3y ago
CVE-2022-3244	—	—	Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation	Oct 17, 2022 3y ago
CVE-2022-3243	—	—	Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi	Oct 17, 2022 3y ago
CVE-2022-41623	high	7.5/10	WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerability	Oct 14, 2022 3y ago
CVE-2022-38086	medium	5.4/10	WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 11, 2022 3y ago
CVE-2021-36915	medium	4.2/10	WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 11, 2022 3y ago
CVE-2021-36899	medium	4.8/10	WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Oct 11, 2022 3y ago
CVE-2022-33978	medium	6.1/10	WordPress FontMeister plugin <= 1.08 - Reflected Cross-Site Scripting (XSS) vulnerability	Oct 11, 2022 3y ago
CVE-2021-36865	low	3.8/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability	Sep 30, 2022 3y ago
CVE-2021-36855	medium	6.1/10	WordPress Booking Ultra Pro plugin <= 1.1.4 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability	Sep 30, 2022 3y ago
CVE-2021-36854	medium	5.4/10	WordPress Booking Ultra Pro plugin <= 1.1.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 30, 2022 3y ago
CVE-2021-36830	medium	4.8/10	WordPress Comment Guestbook plugin <= 0.8.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 30, 2022 3y ago
CVE-2021-36839	medium	4.8/10	WordPress Social Media Follow Buttons Bar plugin <= 4.73 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 30, 2022 3y ago
CVE-2022-3119	—	—	OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass	Sep 26, 2022 3y ago
CVE-2022-38454	medium	5.4/10	WordPress Kraken.io Image Optimizer plugin <= 2.6.5 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38079	medium	5.4/10	WordPress Backup Scheduler plugin <= 1.5.13 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40132	medium	5.4/10	WordPress Seriously Simple Podcasting plugin <= 2.16.0 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38704	medium	5.4/10	WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36340	medium	6.5/10	WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion vulnerability	Sep 23, 2022 3y ago