Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,746

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17551–17580 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-32776	medium	4.8/10	WordPress Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 8, 2022 3y ago
CVE-2022-41980	medium	4.8/10	WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability	Nov 8, 2022 3y ago
CVE-2022-42494	low	3.0/10	WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-38137	medium	4.3/10	WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40206	medium	6.3/10	WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability	Nov 8, 2022 3y ago
CVE-2022-41136	medium	6.1/10	WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS	Nov 8, 2022 3y ago
CVE-2022-40205	medium	5.4/10	WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40632	medium	5.4/10	WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40223	medium	5.4/10	WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability	Nov 8, 2022 3y ago
CVE-2022-30545	medium	4.8/10	WordPress 5 Anker Connect plugin <= 1.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability	Nov 8, 2022 3y ago
CVE-2022-40128	medium	4.3/10	WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-43481	medium	5.4/10	WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-43491	medium	5.4/10	WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 8, 2022 3y ago
CVE-2022-25952	medium	4.3/10	WordPress Content Egg plugin <= 5.4.0 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 3, 2022 3y ago
CVE-2021-36906	low	2.7/10	WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities	Nov 3, 2022 3y ago
CVE-2022-44628	medium	5.9/10	WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 3, 2022 3y ago
CVE-2022-44627	medium	5.4/10	WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 3, 2022 3y ago
CVE-2022-36404	medium	5.4/10	WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability	Nov 3, 2022 3y ago
CVE-2022-40131	medium	5.4/10	WordPress Page View Count plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 3, 2022 3y ago
CVE-2022-36428	medium	4.8/10	WordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerability	Nov 3, 2022 3y ago
CVE-2022-44586	medium	4.8/10	WordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 2, 2022 3y ago
CVE-2022-44576	medium	4.8/10	WordPress AgentEasy Properties plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 2, 2022 3y ago
CVE-2021-36898	high	7.5/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability	Oct 28, 2022 3y ago
CVE-2021-36864	low	3.4/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability	Oct 28, 2022 3y ago
CVE-2021-36863	medium	5.4/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 28, 2022 3y ago
CVE-2021-36858	medium	4.8/10	WordPress Testimonials plugin <= 2.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 28, 2022 3y ago
CVE-2022-41996	high	8.8/10	WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 27, 2022 3y ago
CVE-2022-38104	high	7.2/10	WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability	Oct 21, 2022 3y ago
CVE-2022-40311	medium	4.8/10	WordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Oct 21, 2022 3y ago
CVE-2022-41638	medium	5.4/10	WordPress Pop-Up Chop Chop plugin <= 2.1.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 21, 2022 3y ago