Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,746

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17611–17640 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-40193	medium	6.1/10	WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-35238	medium	6.5/10	WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability	Sep 23, 2022 3y ago
CVE-2022-38460	medium	5.4/10	WordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37328	low	3.4/10	WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36791	medium	5.4/10	WordPress Torro Forms plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40310	medium	4.3/10	WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerability	Sep 23, 2022 3y ago
CVE-2022-40671	medium	4.3/10	WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-38703	low	3.4/10	WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40213	medium	4.1/10	WordPress GS Testimonial Slider plugin <= 1.9.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 23, 2022 3y ago
CVE-2022-38095	medium	5.4/10	WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-36798	medium	5.4/10	WordPress Mega Addons For WPBakery Page Builder plugin <= 4.2.7 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37339	medium	4.1/10	WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-37338	medium	4.1/10	WordPress Blossom Recipe Maker plugin <= 1.0.7 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 23, 2022 3y ago
CVE-2022-37330	medium	5.4/10	WordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 23, 2022 3y ago
CVE-2022-40217	medium	6.5/10	WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability	Sep 21, 2022 3y ago
CVE-2022-38073	medium	5.4/10	WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)	Sep 21, 2022 3y ago
CVE-2022-36365	medium	5.4/10	WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 21, 2022 3y ago
CVE-2022-36383	medium	5.4/10	WordPress Word Search Puzzles game plugin <= 2.0.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 21, 2022 3y ago
CVE-2022-36390	medium	4.1/10	WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Sep 21, 2022 3y ago
CVE-2022-36386	critical	9.1/10	WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability	Sep 21, 2022 3y ago
CVE-2022-40219	medium	5.4/10	WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 21, 2022 3y ago
CVE-2022-1591	—	—	WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRF	Sep 19, 2022 3y ago
CVE-2022-29489	—	—	WordPress Sucuri Security plugin <= 1.8.33 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 16, 2022 3y ago
CVE-2022-38139	medium	5.4/10	WordPress RD Station plugin <= 5.2.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 13, 2022 3y ago
CVE-2022-38135	medium	5.4/10	WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability	Sep 12, 2022 3y ago
CVE-2022-37407	medium	4.1/10	WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Sep 9, 2022 4y ago
CVE-2022-37335	medium	4.8/10	WordPress Word Search Puzzles game plugin <= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-35275	medium	4.8/10	WordPress Advanced Order Export For WooCommerce plugin <= 3.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-38067	medium	6.5/10	WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability	Sep 9, 2022 4y ago
CVE-2022-37412	medium	4.8/10	WordPress Better Delete Revision plugin <= 1.6.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago