Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,048

All time

Critical · Active

11,217

CVSS ≥ 9.0

New · 14 days

3,010

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17251–17280 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-40215	low	3.4/10	WordPress Tabs plugin <= 3.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 23, 2022 3y ago
CVE-2022-36417	medium	6.1/10	WordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38134	medium	4.3/10	WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability	Sep 23, 2022 3y ago
CVE-2022-38470	medium	4.3/10	WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40194	medium	5.3/10	WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerability	Sep 23, 2022 3y ago
CVE-2022-38061	medium	6.2/10	WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability	Sep 23, 2022 3y ago
CVE-2022-40672	medium	4.8/10	WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40195	medium	4.8/10	WordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38085	medium	5.4/10	WordPress Read more By Adam plugin <= 1.1.8 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37342	medium	4.8/10	WordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36388	medium	5.4/10	WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40193	medium	6.1/10	WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-35238	medium	6.5/10	WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability	Sep 23, 2022 3y ago
CVE-2022-38460	medium	5.4/10	WordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37328	low	3.4/10	WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36791	medium	5.4/10	WordPress Torro Forms plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40310	medium	4.3/10	WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerability	Sep 23, 2022 3y ago
CVE-2022-40671	medium	4.3/10	WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38703	low	3.4/10	WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40213	medium	4.1/10	WordPress GS Testimonial Slider plugin <= 1.9.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 23, 2022 3y ago
CVE-2022-38095	medium	5.4/10	WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36798	medium	5.4/10	WordPress Mega Addons For WPBakery Page Builder plugin <= 4.2.7 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37339	medium	4.1/10	WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37338	medium	4.1/10	WordPress Blossom Recipe Maker plugin <= 1.0.7 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 23, 2022 3y ago
CVE-2022-37330	medium	5.4/10	WordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40217	medium	6.5/10	WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability	Sep 21, 2022 3y ago
CVE-2022-38073	medium	5.4/10	WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)	Sep 21, 2022 3y ago
CVE-2022-36365	medium	5.4/10	WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 21, 2022 3y ago
CVE-2022-36383	medium	5.4/10	WordPress Word Search Puzzles game plugin <= 2.0.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 21, 2022 3y ago
CVE-2022-36390	medium	4.1/10	WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Sep 21, 2022 3y ago