Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,176

All time

Critical · Active

11,235

CVSS ≥ 9.0

New · 14 days

3,039

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17461–17490 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-36895	medium	4.7/10	WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload	Apr 26, 2022 4y ago
CVE-2021-36867	medium	5.4/10	WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 26, 2022 4y ago
CVE-2022-29419	medium	6.0/10	WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerability	Apr 25, 2022 4y ago
CVE-2022-29418	medium	4.8/10	WordPress Night Mode plugin <= 1.0.0 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Apr 25, 2022 4y ago
CVE-2022-29417	medium	4.3/10	WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability	Apr 25, 2022 4y ago
CVE-2022-1027	—	—	Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site Scripting	Apr 25, 2022 4y ago
CVE-2021-25111	—	—	English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect	Apr 25, 2022 4y ago
CVE-2022-23976	high	8.1/10	WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)	Apr 18, 2022 4y ago
CVE-2022-23975	medium	6.5/10	WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation	Apr 18, 2022 4y ago
CVE-2021-36828	medium	4.8/10	WordPress WP Maintenance plugin <= 6.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 15, 2022 4y ago
CVE-2021-36914	medium	6.1/10	WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)	Apr 12, 2022 4y ago
CVE-2022-25614	medium	4.3/10	WordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerability	Apr 11, 2022 4y ago
CVE-2022-25615	medium	4.3/10	WordPress eRoom plugin <= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache Deletion	Apr 11, 2022 4y ago
CVE-2021-36893	medium	4.8/10	WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36846	medium	4.8/10	WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36896	medium	4.8/10	WordPress Pricing Table plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36848	low	3.4/10	WordPress Social Media Feather plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36910	low	3.4/10	WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36826	medium	5.4/10	WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2021-36851	medium	4.1/10	WordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2022-25618	low	3.4/10	WordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2022-25613	medium	4.1/10	WordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2022-0537	—	—	MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution	Apr 4, 2022 4y ago
CVE-2022-0770	—	—	Translate WordPress with GTranslate < 2.9.9 - CSRF to Account Takeover	Mar 28, 2022 4y ago
CVE-2021-24962	—	—	WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE	Mar 28, 2022 4y ago
CVE-2022-25612	medium	4.1/10	WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	Mar 25, 2022 4y ago
CVE-2022-25611	medium	4.1/10	WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Mar 25, 2022 4y ago
CVE-2022-25610	low	3.4/10	WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Mar 25, 2022 4y ago
CVE-2022-25606	medium	4.8/10	WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Mar 25, 2022 4y ago
CVE-2022-25609	medium	5.4/10	WordPress Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerability	Mar 23, 2022 4y ago