Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,537

All time

Critical · Active

12,623

CVSS ≥ 9.0

New · 14 days

1,385

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17761–17790 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-37405	medium	4.3/10	WordPress Better Font Awesome plugin <= 2.0.1 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 4y ago
CVE-2022-37404	medium	4.8/10	WordPress add2fav plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-37403	medium	4.8/10	WordPress Add User Role plugin <= 0.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-40191	medium	5.4/10	WordPress Contact Form By Mega Forms plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-38144	—	—	WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 4y ago
CVE-2022-38093	medium	5.4/10	WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Sep 9, 2022 4y ago
CVE-2022-38058	medium	4.3/10	WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability	Sep 9, 2022 4y ago
CVE-2022-36376	medium	6.8/10	WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability	Sep 9, 2022 4y ago
CVE-2022-36356	medium	4.8/10	WordPress Culture Object plugin <= 4.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-38070	medium	5.4/10	WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability	Sep 9, 2022 4y ago
CVE-2022-38068	medium	4.8/10	WordPress Export Post Info plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-35725	medium	4.8/10	WordPress wp-forecast plugin <= 7.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 9, 2022 4y ago
CVE-2022-38059	medium	5.5/10	WordPress Access Code Feeder plugin <= 1.0.3 - Cross-Site Request Forgery (CSRF) vulnerability	Sep 9, 2022 4y ago
CVE-2022-37344	high	7.6/10	WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability	Sep 6, 2022 4y ago
CVE-2022-36427	high	7.3/10	WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability	Sep 6, 2022 4y ago
CVE-2022-36387	high	7.6/10	WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability	Sep 6, 2022 4y ago
CVE-2022-2943	medium	4.9/10	WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read	Sep 6, 2022 4y ago
CVE-2022-2945	medium	4.9/10	WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal	Sep 6, 2022 4y ago
CVE-2022-2934	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URL	Sep 6, 2022 4y ago
CVE-2022-2716	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor	Sep 6, 2022 4y ago
CVE-2022-2695	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'	Sep 6, 2022 4y ago
CVE-2022-2517	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover	Sep 6, 2022 4y ago
CVE-2022-2461	medium	5.3/10	Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change	Sep 6, 2022 4y ago
CVE-2022-2462	medium	5.3/10	Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure	Sep 6, 2022 4y ago
CVE-2022-2433	high	7.5/10	WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization	Sep 6, 2022 4y ago
CVE-2022-36425	medium	5.4/10	WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability	Sep 6, 2022 4y ago
CVE-2022-34656	medium	4.8/10	WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability	Sep 6, 2022 4y ago
CVE-2022-33177	medium	5.4/10	WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulity	Sep 6, 2022 4y ago
CVE-2022-34867	high	7.3/10	WordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerability	Sep 6, 2022 4y ago
CVE-2021-36829	medium	4.8/10	WordPress Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Sep 6, 2022 4y ago