Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,139

All time

Critical · Active

11,233

CVSS ≥ 9.0

New · 14 days

3,013

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17401–17430 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-1010	—	—	Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting	Jun 27, 2022 4y ago
CVE-2021-36827	medium	4.8/10	WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 16, 2022 4y ago
CVE-2022-32280	medium	5.4/10	WordPress XO Slider plugin <= 3.3.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29452	low	3.4/10	WordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-28612	medium	5.4/10	WordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSS	Jun 15, 2022 4y ago
CVE-2021-36891	medium	5.4/10	WordPress Photo Gallery by Supsystic plugin <= 1.15.5 - Cross-Site Request Forgery (CSRF) leading to Plugin Settings Change	Jun 15, 2022 4y ago
CVE-2022-29443	medium	4.1/10	WordPress Hotel Booking plugin <= 3.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jun 15, 2022 4y ago
CVE-2022-29450	medium	5.4/10	WordPress Admin Management Xtended plugin <= 2.4.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Jun 15, 2022 4y ago
CVE-2022-29442	medium	5.4/10	Private Messages For WordPress <= 2.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29441	medium	4.3/10	WordPress Private Messages For WordPress plugin <= 2.1.10 - Sending Messages via Cross-Site Request Forgery (CSRF) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29440	medium	5.4/10	WordPress Promotion Slider plugin <= 3.3.4 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jun 15, 2022 4y ago
CVE-2022-29439	medium	5.4/10	WordPress Image Slider by NextCode plugin <= 1.1.2 - Slider Deletion via Cross-Site Request Forgery (CSRF) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29453	medium	5.4/10	WordPress API KEY for Google Maps plugin <= 1.2.1 - CSRF vulnerability leading to Google Maps API key update	Jun 15, 2022 4y ago
CVE-2022-29438	medium	4.8/10	WordPress Image Slider by NextCode plugin <= 1.1.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29437	medium	5.4/10	WordPress Image Slider by NextCode plugin <= 1.1.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Jun 15, 2022 4y ago
CVE-2022-29406	medium	4.1/10	WordPress Team Manager plugin <= 1.6.9 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jun 15, 2022 4y ago
CVE-2021-36901	medium	6.1/10	WordPress Age Gate plugin <= 2.17.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29455	medium	4.7/10	WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability	Jun 13, 2022 4y ago
CVE-2022-1961	medium	5.5/10	Google Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element ID	Jun 13, 2022 4y ago
CVE-2022-1707	medium	6.1/10	Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search	Jun 13, 2022 4y ago
CVE-2022-1800	—	—	Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection	Jun 13, 2022 4y ago
CVE-2022-1780	—	—	LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS	Jun 13, 2022 4y ago
CVE-2022-1712	—	—	LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRF	Jun 6, 2022 4y ago
CVE-2022-1577	—	—	Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF	Jun 6, 2022 4y ago
CVE-2022-1569	—	—	WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting	Jun 6, 2022 4y ago
CVE-2021-36890	medium	4.3/10	WordPress Social Share Buttons by Supsystic plugin <= 2.2.2 - Cross-Site Request Forgery (CSRF) vulnerability	May 31, 2022 4y ago
CVE-2021-36866	medium	4.8/10	WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	May 31, 2022 4y ago
CVE-2022-29408	medium	4.7/10	WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability	May 25, 2022 4y ago
CVE-2022-29432	low	3.4/10	WordPress wpDataTables plugin <= 2.1.27 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	May 20, 2022 4y ago
CVE-2022-29430	medium	4.7/10	WordPress PNG to JPG plugin <= 4.0 - Cross-Site Request Forgery (CSRF) leading to Persistent Cross-Site Scripting (XSS) vulnerability	May 20, 2022 4y ago