Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,754

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17461–17490 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-4320	—	—	WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS	Jan 16, 2023 3y ago
CVE-2022-45353	medium	4.3/10	WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control	Jan 14, 2023 3y ago
CVE-2022-38467	medium	6.1/10	WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability	Jan 14, 2023 3y ago
CVE-2022-4391	—	—	Vision Interactive For WordPress <= 1.5.3 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2022-4394	—	—	iPages Flipbook For WordPress <= 1.4.6 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2022-4393	—	—	ImageLinks Interactive Image Builder for WordPress <= 1.5.3 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2022-4392	—	—	iPanorama 360 WordPress Virtual Tour Builder <= 1.6.29 - Contributor+ Stored XSS	Jan 9, 2023 3y ago
CVE-2023-0038	high	7.2/10	Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting	Jan 3, 2023 3y ago
CVE-2022-4142	—	—	WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS	Jan 2, 2023 3y ago
CVE-2022-44588	critical	9.9/10	WordPress Cryptocurrency Widgets Pack Plugin <=1.8.1 is vulnerable to SQL Injection	Dec 15, 2022 3y ago
CVE-2022-2536	medium	5.3/10	Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass	Dec 15, 2022 3y ago
CVE-2022-42699	critical	9.1/10	WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)	Dec 6, 2022 3y ago
CVE-2022-45829	high	8.7/10	WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion	Dec 6, 2022 3y ago
CVE-2022-45833	medium	6.8/10	WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal	Dec 6, 2022 3y ago
CVE-2022-45816	medium	4.8/10	WordPress GD bbPress Attachments Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)	Dec 6, 2022 3y ago
CVE-2022-45848	medium	6.1/10	WordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS)	Dec 6, 2022 3y ago
CVE-2022-42888	critical	9.8/10	WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation	Dec 6, 2022 3y ago
CVE-2022-45359	critical	9.8/10	WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload	Dec 6, 2022 3y ago
CVE-2022-45824	medium	5.4/10	WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 5, 2022 3y ago
CVE-2022-45822	critical	10.0/10	WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL Injection	Dec 5, 2022 3y ago
CVE-2022-35730	medium	4.3/10	WordPress Oceanwp sticky header plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 4, 2022 3y ago
CVE-2022-40968	medium	4.8/10	WordPress 2kb Amazon Affiliates Store Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)	Dec 4, 2022 3y ago
CVE-2022-45842	medium	5.3/10	WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability	Nov 30, 2022 3y ago
CVE-2022-26366	medium	5.4/10	WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)	Nov 30, 2022 3y ago
CVE-2022-38140	high	7.6/10	WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload	Nov 28, 2022 3y ago
CVE-2022-34654	medium	4.3/10	WordPress Manage Notification E-mails Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)	Nov 28, 2022 3y ago
CVE-2022-44737	medium	6.5/10	WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Nov 22, 2022 3y ago
CVE-2022-45363	medium	5.4/10	WordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 22, 2022 3y ago
CVE-2022-41609	medium	6.4/10	WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability	Nov 18, 2022 3y ago
CVE-2022-41155	medium	5.3/10	WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability	Nov 18, 2022 3y ago