Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,221

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,741

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17731–17760 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-30998	critical	9.1/10	WordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities	Jul 22, 2022 4y ago
CVE-2022-33191	medium	4.1/10	WordPress Testimonials plugin <= 3.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 22, 2022 4y ago
CVE-2022-34839	medium	5.9/10	WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability	Jul 22, 2022 4y ago
CVE-2022-33960	high	8.5/10	WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities	Jul 22, 2022 4y ago
CVE-2022-29495	medium	5.4/10	WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update	Jul 22, 2022 4y ago
CVE-2022-34487	critical	9.8/10	WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability	Jul 21, 2022 4y ago
CVE-2022-33198	critical	9.8/10	WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability	Jul 21, 2022 4y ago
CVE-2022-31475	medium	5.5/10	WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability	Jul 21, 2022 4y ago
CVE-2022-28700	critical	9.1/10	WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Creation via Export function vulnerability	Jul 21, 2022 4y ago
CVE-2022-30536	low	3.4/10	WordPress WP Maintenance plugin <= 6.0.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 21, 2022 4y ago
CVE-2022-28666	medium	5.3/10	WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 - Broken Access Control vulnerability	Jul 21, 2022 4y ago
CVE-2022-30337	medium	5.4/10	WordPress WP Meta SEO plugin <= 4.4.8 - Social Settings Update vis Cross-Site Request Forgery (CSRF) vulnerability	Jul 21, 2022 4y ago
CVE-2022-32289	medium	5.4/10	WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change	Jul 21, 2022 4y ago
CVE-2022-29923	medium	5.9/10	WordPress Quick Restaurant Reservations plugin <= 1.4.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Jul 20, 2022 4y ago
CVE-2022-29454	low	3.1/10	WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability	Jul 20, 2022 4y ago
CVE-2021-36849	low	3.4/10	WordPress Social Media Share Buttons plugin <= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jul 20, 2022 4y ago
CVE-2022-2444	high	8.8/10	Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization	Jul 18, 2022 4y ago
CVE-2022-1565	high	7.2/10	Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload	Jul 18, 2022 4y ago
CVE-2022-1028	—	—	WordPress Security < 4.2.1 - Admin+ Stored Cross-Site Scripting	Jun 27, 2022 4y ago
CVE-2022-1010	—	—	Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting	Jun 27, 2022 4y ago
CVE-2021-36827	medium	4.8/10	WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 16, 2022 4y ago
CVE-2022-32280	medium	5.4/10	WordPress XO Slider plugin <= 3.3.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29452	low	3.4/10	WordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-28612	medium	5.4/10	WordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSS	Jun 15, 2022 4y ago
CVE-2021-36891	medium	5.4/10	WordPress Photo Gallery by Supsystic plugin <= 1.15.5 - Cross-Site Request Forgery (CSRF) leading to Plugin Settings Change	Jun 15, 2022 4y ago
CVE-2022-29443	medium	4.1/10	WordPress Hotel Booking plugin <= 3.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jun 15, 2022 4y ago
CVE-2022-29450	medium	5.4/10	WordPress Admin Management Xtended plugin <= 2.4.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Jun 15, 2022 4y ago
CVE-2022-29442	medium	5.4/10	Private Messages For WordPress <= 2.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29441	medium	4.3/10	WordPress Private Messages For WordPress plugin <= 2.1.10 - Sending Messages via Cross-Site Request Forgery (CSRF) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29440	medium	5.4/10	WordPress Promotion Slider plugin <= 3.3.4 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jun 15, 2022 4y ago