Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,214

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,746

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 17671–17700 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-33177	medium	5.4/10	WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulity	Sep 6, 2022 4y ago
CVE-2022-34867	high	7.3/10	WordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerability	Sep 6, 2022 4y ago
CVE-2021-36829	medium	4.8/10	WordPress Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 6, 2022 4y ago
CVE-2022-36796	medium	6.1/10	WordPress CallRail Phone Call Tracking plugin <= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)	Sep 1, 2022 4y ago
CVE-2022-36373	medium	5.4/10	WordPress MP3 jPlayer plugin <= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 1, 2022 4y ago
CVE-2022-36355	medium	5.4/10	WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 1, 2022 4y ago
CVE-2022-36358	medium	5.4/10	WordPress SEO Scout plugin <= 0.9.83 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 25, 2022 4y ago
CVE-2022-36389	medium	4.3/10	WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 23, 2022 4y ago
CVE-2022-36405	medium	5.4/10	WordPress amCharts: Charts and Maps plugin <= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 4y ago
CVE-2022-36347	medium	4.8/10	WordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 4y ago
CVE-2022-36292	medium	5.4/10	WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities	Aug 23, 2022 4y ago
CVE-2022-36285	high	7.2/10	WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability	Aug 23, 2022 4y ago
CVE-2022-35726	medium	4.3/10	WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerability	Aug 23, 2022 4y ago
CVE-2022-36379	high	8.8/10	WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings update	Aug 23, 2022 4y ago
CVE-2022-36394	high	7.6/10	WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability	Aug 23, 2022 4y ago
CVE-2022-36341	medium	5.4/10	WordPress AS – Create Pinterest Pinboard Pages plugin <= 1.0 - Authenticated plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 4y ago
CVE-2022-36288	medium	5.4/10	WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Aug 23, 2022 4y ago
CVE-2022-35235	medium	4.9/10	WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability	Aug 23, 2022 4y ago
CVE-2022-36282	medium	4.8/10	WordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 4y ago
CVE-2022-34658	medium	5.4/10	WordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	Aug 23, 2022 4y ago
CVE-2022-33142	high	7.7/10	WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability	Aug 23, 2022 4y ago
CVE-2022-34868	high	8.8/10	WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability	Aug 23, 2022 4y ago
CVE-2022-35242	medium	6.5/10	WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability	Aug 23, 2022 4y ago
CVE-2022-29476	medium	6.1/10	WordPress Notification Bar for WordPress plugin <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 4y ago
CVE-2022-34648	medium	4.8/10	WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 23, 2022 4y ago
CVE-2022-2557	—	—	WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion	Aug 22, 2022 4y ago
CVE-2022-25812	—	—	Transposh WordPress Translation < 1.0.8 - Admin+ RCE	Aug 22, 2022 4y ago
CVE-2022-25811	—	—	Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection	Aug 22, 2022 4y ago
CVE-2022-25810	—	—	Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls	Aug 22, 2022 4y ago
CVE-2021-24912	—	—	Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS	Aug 22, 2022 4y ago