Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,082

All time

Critical · Active

11,227

CVSS ≥ 9.0

New · 14 days

3,031

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17281–17310 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-36386	critical	9.1/10	WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability	Sep 21, 2022 3y ago
CVE-2022-40219	medium	5.4/10	WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 21, 2022 3y ago
CVE-2022-1591	—	—	WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRF	Sep 19, 2022 3y ago
CVE-2022-29489	—	—	WordPress Sucuri Security plugin <= 1.8.33 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 16, 2022 3y ago
CVE-2022-38139	medium	5.4/10	WordPress RD Station plugin <= 5.2.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 13, 2022 3y ago
CVE-2022-38135	medium	5.4/10	WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability	Sep 12, 2022 3y ago
CVE-2022-37407	medium	4.1/10	WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 9, 2022 3y ago
CVE-2022-37335	medium	4.8/10	WordPress Word Search Puzzles game plugin <= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-35275	medium	4.8/10	WordPress Advanced Order Export For WooCommerce plugin <= 3.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-38067	medium	6.5/10	WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability	Sep 9, 2022 3y ago
CVE-2022-37412	medium	4.8/10	WordPress Better Delete Revision plugin <= 1.6.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-37411	medium	5.4/10	WordPress Captcha Code plugin <= 2.7 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 3y ago
CVE-2022-36793	medium	6.5/10	WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities	Sep 9, 2022 3y ago
CVE-2022-35277	medium	5.4/10	WordPress GetResponse plugin <= 5.5.20 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 3y ago
CVE-2022-37405	medium	4.3/10	WordPress Better Font Awesome plugin <= 2.0.1 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 3y ago
CVE-2022-37404	medium	4.8/10	WordPress add2fav plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-37403	medium	4.8/10	WordPress Add User Role plugin <= 0.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-40191	medium	5.4/10	WordPress Contact Form By Mega Forms plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-38144	—	—	WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 3y ago
CVE-2022-38093	medium	5.4/10	WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 9, 2022 3y ago
CVE-2022-38058	medium	4.3/10	WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability	Sep 9, 2022 3y ago
CVE-2022-36376	medium	6.8/10	WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability	Sep 9, 2022 3y ago
CVE-2022-36356	medium	4.8/10	WordPress Culture Object plugin <= 4.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-38070	medium	5.4/10	WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability	Sep 9, 2022 3y ago
CVE-2022-38068	medium	4.8/10	WordPress Export Post Info plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-35725	medium	4.8/10	WordPress wp-forecast plugin <= 7.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 3y ago
CVE-2022-38059	medium	5.5/10	WordPress Access Code Feeder plugin <= 1.0.3 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 3y ago
CVE-2022-37344	high	7.6/10	WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability	Sep 6, 2022 3y ago
CVE-2022-36427	high	7.3/10	WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability	Sep 6, 2022 3y ago
CVE-2022-36387	high	7.6/10	WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability	Sep 6, 2022 3y ago