Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,176

All time

Critical · Active

11,235

CVSS ≥ 9.0

New · 14 days

3,030

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17491–17520 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-25608	medium	5.4/10	WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to slider Duplicate/Delete	Mar 23, 2022 4y ago
CVE-2022-25607	medium	6.6/10	WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability	Mar 18, 2022 4y ago
CVE-2022-25605	medium	4.8/10	WordPress WP-DownloadManager plugin <= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Mar 18, 2022 4y ago
CVE-2022-25602	high	8.3/10	WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability	Mar 18, 2022 4y ago
CVE-2022-25604	medium	4.1/10	WordPress Price Table plugin <= 0.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2021-23209	medium	4.8/10	WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities	Mar 18, 2022 4y ago
CVE-2021-23150	medium	4.8/10	WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2021-44760	medium	4.8/10	WordPress WP-DownloadManager plugin <= 1.68.6 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2022-25603	medium	4.8/10	WordPress MaxGalleria plugin <= 6.2.5 - Stored Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2022-0230	—	—	Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting	Mar 14, 2022 4y ago
CVE-2021-25026	—	—	Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting	Mar 14, 2022 4y ago
CVE-2022-25600	medium	5.4/10	WordPress WP Google Map plugin <= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerability	Mar 11, 2022 4y ago
CVE-2022-25601	medium	4.7/10	WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability	Mar 11, 2022 4y ago
CVE-2022-0445	—	—	WordPress Real Cookie Banner < 2.14.2 - Settings Reset via CSRF	Mar 7, 2022 4y ago
CVE-2021-25087	—	—	Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure	Mar 7, 2022 4y ago
CVE-2021-24961	—	—	WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode	Mar 7, 2022 4y ago
CVE-2021-24960	—	—	WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG	Mar 7, 2022 4y ago
CVE-2021-26256	medium	4.7/10	WordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Feb 21, 2022 4y ago
CVE-2022-25599	medium	5.4/10	WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability	Feb 21, 2022 4y ago
CVE-2022-23984	low	3.7/10	WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure	Feb 21, 2022 4y ago
CVE-2022-23983	medium	4.3/10	WordPress WP Content Copy Protection & No Right Click plugin <= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerability	Feb 21, 2022 4y ago
CVE-2022-0255	—	—	Database Backup for WordPress < 2.5.1 - Admin+ SQL Injection	Feb 21, 2022 4y ago
CVE-2021-25069	—	—	WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS	Feb 21, 2022 4y ago
CVE-2021-25055	—	—	FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)	Feb 21, 2022 4y ago
CVE-2022-23982	medium	4.3/10	WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Server Information Exposure vulnerability	Feb 18, 2022 4y ago
CVE-2022-23981	medium	4.3/10	WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability	Feb 18, 2022 4y ago
CVE-2022-0208	—	—	MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting	Feb 14, 2022 4y ago
CVE-2022-23980	medium	4.7/10	WordPress Yasr – Yet Another Stars Rating plugin <= 2.9.9 - Cross-Site Scripting (XSS) vulnerability	Feb 4, 2022 4y ago
CVE-2021-44779	high	7.3/10	WordPress [GWA] AutoResponder plugin <= 2.3 - Unauthenticated SQL Injection (SQLi) vulnerability	Feb 4, 2022 4y ago
CVE-2022-0220	—	—	WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting	Feb 1, 2022 4y ago