Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,221

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,741

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17701–17730 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-24911	—	—	Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting	Aug 22, 2022 4y ago
CVE-2021-24910	—	—	Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting	Aug 22, 2022 4y ago
CVE-2022-34857	medium	6.1/10	WordPress SP Project & Document Manager plugin <= 4.59 - Reflected Cross-Site Scripting (XSS) vulnerability	Aug 22, 2022 4y ago
CVE-2022-36346	medium	4.3/10	WordPress MaxButtons plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Aug 22, 2022 4y ago
CVE-2022-34149	critical	9.8/10	WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability	Aug 22, 2022 4y ago
CVE-2022-34858	critical	9.8/10	WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability	Aug 22, 2022 4y ago
CVE-2022-33900	medium	4.1/10	WordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerability	Aug 22, 2022 4y ago
CVE-2022-34347	medium	4.2/10	WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 22, 2022 4y ago
CVE-2021-36857	medium	4.8/10	WordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 22, 2022 4y ago
CVE-2021-36852	medium	4.3/10	WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 22, 2022 4y ago
CVE-2021-36847	medium	4.8/10	WordPress Webba Booking plugin <= 4.2.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 22, 2022 4y ago
CVE-2022-36284	medium	6.4/10	WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Authenticated IDOR vulnerability leading to PayPal email change	Aug 5, 2022 4y ago
CVE-2021-36861	medium	5.4/10	WordPress Rich Reviews by Starfish plugin <= 1.9.14 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 5, 2022 4y ago
CVE-2022-33201	medium	6.3/10	WordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability	Aug 5, 2022 4y ago
CVE-2022-36296	medium	6.5/10	WordPress ActiveDEMAND plugin <= 0.2.27 - Broken Authentication vulnerability	Aug 5, 2022 4y ago
CVE-2022-25649	medium	5.0/10	WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilities	Aug 5, 2022 4y ago
CVE-2022-34154	high	7.2/10	WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability	Aug 1, 2022 4y ago
CVE-2022-36343	low	3.4/10	WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Aug 1, 2022 4y ago
CVE-2022-2305	—	—	WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site Scripting	Aug 1, 2022 4y ago
CVE-2022-2181	—	—	Advanced WordPress Reset < 1.6 - Reflected Cross-Site Scripting	Aug 1, 2022 4y ago
CVE-2022-36378	medium	4.8/10	WordPress Floating Div plugin <= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 29, 2022 4y ago
CVE-2022-35882	medium	4.8/10	WordPress GS Testimonial Slider plugin <= 1.9.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 28, 2022 4y ago
CVE-2022-33943	medium	5.4/10	WordPress BxSlider WP plugin <= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerability	Jul 27, 2022 4y ago
CVE-2022-33970	high	7.2/10	WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability	Jul 27, 2022 4y ago
CVE-2022-36375	high	7.2/10	WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability	Jul 25, 2022 4y ago
CVE-2022-33969	high	7.2/10	WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability	Jul 25, 2022 4y ago
CVE-2022-33965	critical	9.3/10	WordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities	Jul 25, 2022 4y ago
CVE-2022-33901	medium	5.3/10	WordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerability	Jul 22, 2022 4y ago
CVE-2022-34650	medium	4.1/10	WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jul 22, 2022 4y ago
CVE-2022-34853	medium	4.1/10	WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	Jul 22, 2022 4y ago