Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,754

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17371–17400 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-1470	medium	4.4/10	eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting	Mar 17, 2023 3y ago
CVE-2021-36821	high	7.1/10	WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability	Mar 16, 2023 3y ago
CVE-2022-41554	medium	4.8/10	WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)	Mar 16, 2023 3y ago
CVE-2022-40699	medium	5.4/10	WordPress Yet Another Stars Rating Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)	Mar 16, 2023 3y ago
CVE-2022-38971	medium	4.7/10	WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)	Mar 16, 2023 3y ago
CVE-2022-38063	medium	5.4/10	WordPress Social Login WP Plugin <= 5.0.0.0 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 16, 2023 3y ago
CVE-2022-37402	medium	4.8/10	WordPress AFS Analytics Plugin <= 4.18 is vulnerable to Cross Site Scripting (XSS)	Mar 15, 2023 3y ago
CVE-2022-34148	medium	4.8/10	WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)	Mar 15, 2023 3y ago
CVE-2022-38456	medium	4.3/10	WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure	Mar 15, 2023 3y ago
CVE-2022-44580	critical	9.1/10	WordPress Plugin for Google Reviews Plugin <= 2.2.3 is vulnerable to SQL Injection	Mar 15, 2023 3y ago
CVE-2022-47427	medium	5.4/10	WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2023-25708	medium	4.3/10	WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2023-25709	medium	5.4/10	WordPress Locatoraid Store Locator Plugin <= 3.9.11 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2023-25968	medium	4.3/10	WordPress Client Portal – Private user pages and login Plugin <= 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 15, 2023 3y ago
CVE-2022-47143	medium	4.3/10	WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47141	medium	5.4/10	WordPress WP Dynamic Keywords Injector Plugin <= 2.3.15 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47422	medium	4.3/10	WordPress WordPress Stripe Donation and Payment Plugin Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47147	medium	5.4/10	WordPress ipBlockList Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47443	medium	4.3/10	WordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47154	medium	4.3/10	WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47155	medium	4.3/10	WordPress Slider by Supsystic Plugin <= 1.8.5 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47162	medium	4.3/10	WordPress DH – Anti AdBlocker Plugin <= 36 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47163	low	3.1/10	WordPress WP CSV to Database Plugin <= 2.6 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 14, 2023 3y ago
CVE-2022-47171	medium	5.9/10	WordPress IP Vault – WP Firewall Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)	Mar 14, 2023 3y ago
CVE-2022-47595	medium	4.9/10	WordPress WP Google Maps Plugin <= 9.0.15 is vulnerable to Path Traversal	Mar 14, 2023 3y ago
CVE-2022-4466	—	—	WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSS	Mar 13, 2023 3y ago
CVE-2023-25973	medium	5.4/10	WordPress Auto Affiliate Links Plugin <= 6.3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 13, 2023 3y ago
CVE-2023-22700	medium	4.3/10	WordPress PixelYourSite – Your smart PIXEL (TAG) Manager Plugin <= 9.3.0 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 13, 2023 3y ago
CVE-2023-25991	medium	5.4/10	WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)	Mar 13, 2023 3y ago
CVE-2022-38074	critical	9.9/10	WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection	Mar 13, 2023 3y ago