Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,099

All time

Critical · Active

11,230

CVSS ≥ 9.0

New · 14 days

3,010

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17341–17370 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-34658	medium	5.4/10	WordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	Aug 23, 2022 3y ago
CVE-2022-33142	high	7.7/10	WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability	Aug 23, 2022 3y ago
CVE-2022-34868	high	8.8/10	WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability	Aug 23, 2022 3y ago
CVE-2022-35242	medium	6.5/10	WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability	Aug 23, 2022 3y ago
CVE-2022-29476	medium	6.1/10	WordPress Notification Bar for WordPress plugin <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 3y ago
CVE-2022-34648	medium	4.8/10	WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 3y ago
CVE-2022-2557	—	—	WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion	Aug 22, 2022 3y ago
CVE-2022-25812	—	—	Transposh WordPress Translation < 1.0.8 - Admin+ RCE	Aug 22, 2022 3y ago
CVE-2022-25811	—	—	Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection	Aug 22, 2022 3y ago
CVE-2022-25810	—	—	Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls	Aug 22, 2022 3y ago
CVE-2021-24912	—	—	Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS	Aug 22, 2022 3y ago
CVE-2021-24911	—	—	Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting	Aug 22, 2022 3y ago
CVE-2021-24910	—	—	Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting	Aug 22, 2022 3y ago
CVE-2022-34857	medium	6.1/10	WordPress SP Project & Document Manager plugin <= 4.59 - Reflected Cross-Site Scripting (XSS) vulnerability	Aug 22, 2022 3y ago
CVE-2022-36346	medium	4.3/10	WordPress MaxButtons plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Aug 22, 2022 3y ago
CVE-2022-34149	critical	9.8/10	WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability	Aug 22, 2022 3y ago
CVE-2022-34858	critical	9.8/10	WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability	Aug 22, 2022 3y ago
CVE-2022-33900	medium	4.1/10	WordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerability	Aug 22, 2022 3y ago
CVE-2022-34347	medium	4.2/10	WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 22, 2022 3y ago
CVE-2021-36857	medium	4.8/10	WordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 22, 2022 3y ago
CVE-2021-36852	medium	4.3/10	WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 22, 2022 3y ago
CVE-2021-36847	medium	4.8/10	WordPress Webba Booking plugin <= 4.2.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 22, 2022 3y ago
CVE-2022-36284	medium	6.4/10	WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Authenticated IDOR vulnerability leading to PayPal email change	Aug 5, 2022 3y ago
CVE-2021-36861	medium	5.4/10	WordPress Rich Reviews by Starfish plugin <= 1.9.14 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 5, 2022 3y ago
CVE-2022-33201	medium	6.3/10	WordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 5, 2022 3y ago
CVE-2022-36296	medium	6.5/10	WordPress ActiveDEMAND plugin <= 0.2.27 - Broken Authentication vulnerability	Aug 5, 2022 3y ago
CVE-2022-25649	medium	5.0/10	WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilities	Aug 5, 2022 3y ago
CVE-2022-34154	high	7.2/10	WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability	Aug 1, 2022 4y ago
CVE-2022-36343	low	3.4/10	WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 1, 2022 4y ago
CVE-2022-2305	—	—	WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site Scripting	Aug 1, 2022 4y ago