Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,082

All time

Critical · Active

11,227

CVSS ≥ 9.0

New · 14 days

3,018

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17311–17340 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-2943	medium	4.9/10	WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read	Sep 6, 2022 3y ago
CVE-2022-2945	medium	4.9/10	WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal	Sep 6, 2022 3y ago
CVE-2022-2934	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URL	Sep 6, 2022 3y ago
CVE-2022-2716	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor	Sep 6, 2022 3y ago
CVE-2022-2695	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'	Sep 6, 2022 3y ago
CVE-2022-2517	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover	Sep 6, 2022 3y ago
CVE-2022-2461	medium	5.3/10	Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change	Sep 6, 2022 3y ago
CVE-2022-2462	medium	5.3/10	Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure	Sep 6, 2022 3y ago
CVE-2022-2433	high	7.5/10	WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization	Sep 6, 2022 3y ago
CVE-2022-36425	medium	5.4/10	WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability	Sep 6, 2022 3y ago
CVE-2022-34656	medium	4.8/10	WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability	Sep 6, 2022 3y ago
CVE-2022-33177	medium	5.4/10	WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulity	Sep 6, 2022 3y ago
CVE-2022-34867	high	7.3/10	WordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerability	Sep 6, 2022 3y ago
CVE-2021-36829	medium	4.8/10	WordPress Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 6, 2022 3y ago
CVE-2022-36796	medium	6.1/10	WordPress CallRail Phone Call Tracking plugin <= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)	Sep 1, 2022 3y ago
CVE-2022-36373	medium	5.4/10	WordPress MP3 jPlayer plugin <= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 1, 2022 3y ago
CVE-2022-36355	medium	5.4/10	WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 1, 2022 3y ago
CVE-2022-36358	medium	5.4/10	WordPress SEO Scout plugin <= 0.9.83 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 25, 2022 3y ago
CVE-2022-36389	medium	4.3/10	WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 23, 2022 3y ago
CVE-2022-36405	medium	5.4/10	WordPress amCharts: Charts and Maps plugin <= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 3y ago
CVE-2022-36347	medium	4.8/10	WordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 3y ago
CVE-2022-36292	medium	5.4/10	WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities	Aug 23, 2022 3y ago
CVE-2022-36285	high	7.2/10	WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability	Aug 23, 2022 3y ago
CVE-2022-35726	medium	4.3/10	WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerability	Aug 23, 2022 3y ago
CVE-2022-36379	high	8.8/10	WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings update	Aug 23, 2022 3y ago
CVE-2022-36394	high	7.6/10	WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability	Aug 23, 2022 3y ago
CVE-2022-36341	medium	5.4/10	WordPress AS – Create Pinterest Pinboard Pages plugin <= 1.0 - Authenticated plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 3y ago
CVE-2022-36288	medium	5.4/10	WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Aug 23, 2022 3y ago
CVE-2022-35235	medium	4.9/10	WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability	Aug 23, 2022 3y ago
CVE-2022-36282	medium	4.8/10	WordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 3y ago