Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,754

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17431–17460 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-25066	medium	4.3/10	WordPress FV Flowplayer Video Player Plugin <= 7.5.30.7212 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 14, 2023 3y ago
CVE-2022-43469	medium	5.4/10	WordPress Corona Virus (COVID-19) Banner & Live Data Plugin <= 1.7.0.6 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 14, 2023 3y ago
CVE-2022-41134	medium	5.4/10	WordPress Optinly Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 13, 2023 3y ago
CVE-2023-0270	—	—	YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS	Feb 13, 2023 3y ago
CVE-2022-41620	medium	5.4/10	WordPress SeoSamba for WordPress Webmasters Plugin <= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 8, 2023 3y ago
CVE-2022-4626	—	—	PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode	Feb 6, 2023 3y ago
CVE-2022-4321	—	—	PDF Generator for WordPress < 1.1.2 - Reflected XSS	Feb 6, 2023 3y ago
CVE-2022-4674	—	—	Ibtana – WordPress Website Builder < 1.1.8.8 - Contributor+ Stored XSS via Shortcode	Feb 6, 2023 3y ago
CVE-2022-29416	medium	4.7/10	WordPress Afterpay Gateway for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)	Feb 6, 2023 3y ago
CVE-2022-46842	medium	5.4/10	WordPress JS Help Desk plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-46815	medium	5.4/10	WordPress Conditional Shipping for WooCommerce Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-45807	medium	5.4/10	WordPress WP Mail Log Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-45067	medium	4.3/10	WordPress Exclusive Addons Elementor Plugin <= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-40692	medium	5.4/10	WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-44585	medium	5.4/10	WordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-36401	medium	5.4/10	WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-4654	—	—	Pricing Tables WordPress Plugin – Easy Pricing Tables < 3.2.3 - Contributor+ Stored XSS via Shortcode	Jan 30, 2023 3y ago
CVE-2022-4496	—	—	miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login	Jan 30, 2023 3y ago
CVE-2022-45820	critical	9.1/10	WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection	Jan 24, 2023 3y ago
CVE-2022-45808	critical	9.9/10	WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection	Jan 24, 2023 3y ago
CVE-2022-47615	critical	9.3/10	WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion	Jan 24, 2023 3y ago
CVE-2023-22721	medium	6.5/10	WordPress Oi Yandex.Maps for WordPress Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)	Jan 23, 2023 3y ago
CVE-2022-4650	—	—	HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode	Jan 23, 2023 3y ago
CVE-2022-4383	—	—	CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQLi	Jan 23, 2023 3y ago
CVE-2022-4672	—	—	WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via Shortcode	Jan 23, 2023 3y ago
CVE-2022-4832	—	—	Store Locator WordPress < 1.4.9 - Contributor+ Stored XSS via Shortcode	Jan 23, 2023 3y ago
CVE-2022-40697	medium	4.8/10	WordPress 3com – Asesor de Cookies para normativa española Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)	Jan 19, 2023 3y ago
CVE-2022-43462	critical	9.1/10	WordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to SQL Injection (SQLi) vulnerability	Jan 17, 2023 3y ago
CVE-2022-42462	medium	4.8/10	WordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to Cross Site Scripting (XSS)	Jan 17, 2023 3y ago
CVE-2022-30544	medium	4.3/10	WordPress OSM – OpenStreetMap Plugin <= 6.0.1 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 17, 2023 3y ago