Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,139

All time

Critical · Active

11,233

CVSS ≥ 9.0

New · 14 days

3,038

Newly disclosed

Feed last synced

27 mins ago

Data freshness

Showing 17371–17400 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-2181	—	—	Advanced WordPress Reset < 1.6 - Reflected Cross-Site Scripting	Aug 1, 2022 4y ago
CVE-2022-36378	medium	4.8/10	WordPress Floating Div plugin <= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 29, 2022 4y ago
CVE-2022-35882	medium	4.8/10	WordPress GS Testimonial Slider plugin <= 1.9.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 28, 2022 4y ago
CVE-2022-33943	medium	5.4/10	WordPress BxSlider WP plugin <= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerability	Jul 27, 2022 4y ago
CVE-2022-33970	high	7.2/10	WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability	Jul 27, 2022 4y ago
CVE-2022-36375	high	7.2/10	WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability	Jul 25, 2022 4y ago
CVE-2022-33969	high	7.2/10	WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability	Jul 25, 2022 4y ago
CVE-2022-33965	critical	9.3/10	WordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities	Jul 25, 2022 4y ago
CVE-2022-33901	medium	5.3/10	WordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerability	Jul 22, 2022 4y ago
CVE-2022-34650	medium	4.1/10	WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jul 22, 2022 4y ago
CVE-2022-34853	medium	4.1/10	WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	Jul 22, 2022 4y ago
CVE-2022-30998	critical	9.1/10	WordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities	Jul 22, 2022 4y ago
CVE-2022-33191	medium	4.1/10	WordPress Testimonials plugin <= 3.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 22, 2022 4y ago
CVE-2022-34839	medium	5.9/10	WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability	Jul 22, 2022 4y ago
CVE-2022-33960	high	8.5/10	WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities	Jul 22, 2022 4y ago
CVE-2022-29495	medium	5.4/10	WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update	Jul 22, 2022 4y ago
CVE-2022-34487	critical	9.8/10	WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability	Jul 21, 2022 4y ago
CVE-2022-33198	critical	9.8/10	WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability	Jul 21, 2022 4y ago
CVE-2022-31475	medium	5.5/10	WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability	Jul 21, 2022 4y ago
CVE-2022-28700	critical	9.1/10	WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Creation via Export function vulnerability	Jul 21, 2022 4y ago
CVE-2022-30536	low	3.4/10	WordPress WP Maintenance plugin <= 6.0.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 21, 2022 4y ago
CVE-2022-28666	medium	5.3/10	WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 - Broken Access Control vulnerability	Jul 21, 2022 4y ago
CVE-2022-30337	medium	5.4/10	WordPress WP Meta SEO plugin <= 4.4.8 - Social Settings Update vis Cross-Site Request Forgery (CSRF) vulnerability	Jul 21, 2022 4y ago
CVE-2022-32289	medium	5.4/10	WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change	Jul 21, 2022 4y ago
CVE-2022-29923	medium	5.9/10	WordPress Quick Restaurant Reservations plugin <= 1.4.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Jul 20, 2022 4y ago
CVE-2022-29454	low	3.1/10	WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability	Jul 20, 2022 4y ago
CVE-2021-36849	low	3.4/10	WordPress Social Media Share Buttons plugin <= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 20, 2022 4y ago
CVE-2022-2444	high	8.8/10	Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization	Jul 18, 2022 4y ago
CVE-2022-1565	high	7.2/10	Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload	Jul 18, 2022 4y ago
CVE-2022-1028	—	—	WordPress Security < 4.2.1 - Admin+ Stored Cross-Site Scripting	Jun 27, 2022 4y ago