Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,191

All time

Critical · Active

11,235

CVSS ≥ 9.0

New · 14 days

3,034

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17521–17550 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-24814	—	—	WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting	Feb 1, 2022 4y ago
CVE-2022-23979	medium	4.8/10	WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jan 28, 2022 4y ago
CVE-2021-31567	medium	6.8/10	WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability	Jan 28, 2022 4y ago
CVE-2021-23174	low	3.4/10	WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Jan 28, 2022 4y ago
CVE-2021-45729	medium	5.4/10	WordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerability	Jan 25, 2022 4y ago
CVE-2021-44777	medium	5.4/10	WordPress Email Tracker plugin <= 5.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion	Jan 19, 2022 4y ago
CVE-2021-36920	medium	4.8/10	WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Jan 14, 2022 4y ago
CVE-2021-23227	medium	5.4/10	WordPress PHP Everywhere Plugin <= 2.0.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 13, 2022 4y ago
CVE-2022-21662	high	8.0/10	Stored XSS in WordPress	Jan 6, 2022 4y ago
CVE-2022-21663	medium	6.6/10	Authenticated Object Injection in Multisites in WordPress	Jan 6, 2022 4y ago
CVE-2022-21664	high	7.4/10	SQL injection in WordPress	Jan 6, 2022 4y ago
CVE-2022-21661	high	8.0/10	SQL injection in WordPress	Jan 6, 2022 4y ago
CVE-2021-36886	medium	6.5/10	WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability	Dec 22, 2021 4y ago
CVE-2021-36885	medium	6.1/10	WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Dec 22, 2021 4y ago
CVE-2021-36887	medium	6.1/10	WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)	Dec 20, 2021 4y ago
CVE-2021-36889	low	3.4/10	WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities	Dec 20, 2021 4y ago
CVE-2021-36888	critical	9.8/10	WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise	Dec 15, 2021 4y ago
CVE-2021-36911	medium	4.8/10	WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability	Dec 10, 2021 4y ago
CVE-2021-36919	medium	6.1/10	WordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities	Nov 26, 2021 4y ago
CVE-2021-36843	medium	4.8/10	WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Nov 26, 2021 4y ago
CVE-2021-36916	high	8.6/10	WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability	Nov 24, 2021 4y ago
CVE-2021-36917	medium	6.5/10	WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability	Nov 24, 2021 4y ago
CVE-2021-24875	—	—	eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting	Nov 23, 2021 4y ago
CVE-2021-36884	medium	4.8/10	WordPress Backup Migration plugin <= 1.1.5 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Nov 19, 2021 4y ago
CVE-2021-43408	medium	6.5/10	Duplicate Post WordPress Plugin SQL Injection Vulnerability	Nov 19, 2021 4y ago
CVE-2021-43409	critical	9.3/10	WPO365 \| LOGIN - Wordpress Plugin Persistent Cross-Site Scripting	Nov 19, 2021 4y ago
CVE-2021-36909	high	8.8/10	WordPress WP Reset PRO Premium plugin <= 5.98 - Authenticated Database Reset vulnerability	Nov 18, 2021 4y ago
CVE-2021-36908	high	8.8/10	WordPress WP Reset PRO Premium Plugin <= 5.98 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 18, 2021 4y ago
CVE-2021-42362	high	8.8/10	WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload	Nov 17, 2021 4y ago
CVE-2021-24594	—	—	Translate WordPress - Google Language Translator < 6.0.12 - Admin+ Stored Cross-Site Scripting	Nov 8, 2021 4y ago