Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,754

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17491–17520 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-40216	medium	4.3/10	WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability	Nov 18, 2022 3y ago
CVE-2022-40130	medium	4.3/10	WordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability	Nov 18, 2022 3y ago
CVE-2022-41618	low	3.7/10	WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability	Nov 18, 2022 3y ago
CVE-2022-41615	medium	6.1/10	WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability	Nov 18, 2022 3y ago
CVE-2022-41634	medium	5.4/10	WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 18, 2022 3y ago
CVE-2022-41135	medium	6.5/10	WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability	Nov 18, 2022 3y ago
CVE-2022-41655	medium	4.3/10	WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability	Nov 18, 2022 3y ago
CVE-2022-41643	medium	4.8/10	WordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 18, 2022 3y ago
CVE-2022-40963	medium	4.8/10	WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities	Nov 18, 2022 3y ago
CVE-2022-42459	high	7.2/10	WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability	Nov 18, 2022 3y ago
CVE-2022-40695	medium	5.4/10	WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities	Nov 18, 2022 3y ago
CVE-2022-42698	critical	9.8/10	WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability	Nov 18, 2022 3y ago
CVE-2022-42497	critical	10.0/10	WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary Code Execution vulnerability	Nov 18, 2022 3y ago
CVE-2022-41788	medium	5.4/10	WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability	Nov 18, 2022 3y ago
CVE-2022-43492	medium	4.3/10	WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability	Nov 18, 2022 3y ago
CVE-2022-44740	medium	5.4/10	WordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Nov 18, 2022 3y ago
CVE-2022-44583	high	7.5/10	WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability	Nov 18, 2022 3y ago
CVE-2022-44584	critical	9.1/10	WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability	Nov 18, 2022 3y ago
CVE-2022-45082	low	3.4/10	WordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities	Nov 18, 2022 3y ago
CVE-2022-44634	medium	4.9/10	WordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability	Nov 18, 2022 3y ago
CVE-2022-45369	medium	4.3/10	WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability	Nov 18, 2022 3y ago
CVE-2022-41839	medium	5.3/10	WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability	Nov 18, 2022 3y ago
CVE-2022-42883	medium	5.3/10	WordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerability	Nov 18, 2022 3y ago
CVE-2022-40698	medium	5.4/10	WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability	Nov 18, 2022 3y ago
CVE-2022-45073	medium	5.4/10	WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 18, 2022 3y ago
CVE-2022-42461	medium	5.4/10	WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability	Nov 18, 2022 3y ago
CVE-2022-43482	medium	4.3/10	WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability	Nov 18, 2022 3y ago
CVE-2022-41781	medium	6.5/10	WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability	Nov 18, 2022 3y ago
CVE-2022-38075	medium	6.1/10	WordPress Mantenimiento web plugin <= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)	Nov 18, 2022 3y ago
CVE-2022-41692	medium	4.3/10	WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerability	Nov 18, 2022 3y ago