Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,746

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17581–17610 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-26375	medium	4.8/10	WordPress AB Press Optimizer plugin <= 1.1.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Oct 17, 2022 3y ago
CVE-2022-3244	—	—	Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation	Oct 17, 2022 3y ago
CVE-2022-3243	—	—	Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi	Oct 17, 2022 3y ago
CVE-2022-41623	high	7.5/10	WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerability	Oct 14, 2022 3y ago
CVE-2022-38086	medium	5.4/10	WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 11, 2022 3y ago
CVE-2021-36915	medium	4.2/10	WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 11, 2022 3y ago
CVE-2021-36899	medium	4.8/10	WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Oct 11, 2022 3y ago
CVE-2022-33978	medium	6.1/10	WordPress FontMeister plugin <= 1.08 - Reflected Cross-Site Scripting (XSS) vulnerability	Oct 11, 2022 3y ago
CVE-2021-36865	low	3.8/10	WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability	Sep 30, 2022 3y ago
CVE-2021-36855	medium	6.1/10	WordPress Booking Ultra Pro plugin <= 1.1.4 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability	Sep 30, 2022 3y ago
CVE-2021-36854	medium	5.4/10	WordPress Booking Ultra Pro plugin <= 1.1.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 30, 2022 3y ago
CVE-2021-36830	medium	4.8/10	WordPress Comment Guestbook plugin <= 0.8.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 30, 2022 3y ago
CVE-2021-36839	medium	4.8/10	WordPress Social Media Follow Buttons Bar plugin <= 4.73 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 30, 2022 3y ago
CVE-2022-3119	—	—	OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass	Sep 26, 2022 3y ago
CVE-2022-38454	medium	5.4/10	WordPress Kraken.io Image Optimizer plugin <= 2.6.5 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38079	medium	5.4/10	WordPress Backup Scheduler plugin <= 1.5.13 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40132	medium	5.4/10	WordPress Seriously Simple Podcasting plugin <= 2.16.0 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38704	medium	5.4/10	WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36340	medium	6.5/10	WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion vulnerability	Sep 23, 2022 3y ago
CVE-2022-40215	low	3.4/10	WordPress Tabs plugin <= 3.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 23, 2022 3y ago
CVE-2022-36417	medium	6.1/10	WordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38134	medium	4.3/10	WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability	Sep 23, 2022 3y ago
CVE-2022-38470	medium	4.3/10	WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40194	medium	5.3/10	WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerability	Sep 23, 2022 3y ago
CVE-2022-38061	medium	6.2/10	WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability	Sep 23, 2022 3y ago
CVE-2022-40672	medium	4.8/10	WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40195	medium	4.8/10	WordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38085	medium	5.4/10	WordPress Read more By Adam plugin <= 1.1.8 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37342	medium	4.8/10	WordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36388	medium	5.4/10	WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago