Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,221

All time

Critical · Active

12,288

CVSS ≥ 9.0

New · 14 days

1,741

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17791–17820 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-25617	medium	4.7/10	WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability	May 18, 2022 4y ago
CVE-2022-29445	medium	6.8/10	WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability	May 18, 2022 4y ago
CVE-2022-29435	medium	5.4/10	WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability	May 17, 2022 4y ago
CVE-2022-29436	medium	4.7/10	WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS)	May 17, 2022 4y ago
CVE-2022-29429	high	8.8/10	WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE) vulnerability	May 17, 2022 4y ago
CVE-2022-29433	medium	4.1/10	https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability	May 13, 2022 4y ago
CVE-2022-29423	low	3.8/10	WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability	May 6, 2022 4y ago
CVE-2022-29422	medium	4.8/10	WordPress Countdown & Clock plugin <= 2.3.2 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	May 6, 2022 4y ago
CVE-2022-29421	medium	4.7/10	WordPress Countdown & Clock plugin <= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerability	May 6, 2022 4y ago
CVE-2022-29420	medium	5.9/10	WordPress Countdown & Clock plugin <= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	May 6, 2022 4y ago
CVE-2021-36844	low	3.4/10	WordPress WP Subscribe plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	May 2, 2022 4y ago
CVE-2022-29444	medium	6.5/10	WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability	May 2, 2022 4y ago
CVE-2022-29451	high	8.8/10	WordPress Rara One Click Demo Import plugin <= 1.2.9 - Cross-Site Request Forgery (CSRF) leads to Arbitrary File Upload vulnerability	Apr 29, 2022 4y ago
CVE-2022-29414	medium	5.4/10	WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Apr 29, 2022 4y ago
CVE-2022-29411	high	8.3/10	WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerability	Apr 28, 2022 4y ago
CVE-2022-29412	medium	5.4/10	WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Apr 28, 2022 4y ago
CVE-2022-29413	medium	4.7/10	WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability	Apr 28, 2022 4y ago
CVE-2022-29410	high	7.4/10	WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Authenticated SQL Injection (SQLi) vulnerability	Apr 28, 2022 4y ago
CVE-2022-29415	medium	6.1/10	WordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability	Apr 28, 2022 4y ago
CVE-2021-36895	medium	4.7/10	WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload	Apr 26, 2022 4y ago
CVE-2021-36867	medium	5.4/10	WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 26, 2022 4y ago
CVE-2022-29419	medium	6.0/10	WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerability	Apr 25, 2022 4y ago
CVE-2022-29418	medium	4.8/10	WordPress Night Mode plugin <= 1.0.0 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Apr 25, 2022 4y ago
CVE-2022-29417	medium	4.3/10	WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability	Apr 25, 2022 4y ago
CVE-2022-1027	—	—	Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site Scripting	Apr 25, 2022 4y ago
CVE-2021-25111	—	—	English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect	Apr 25, 2022 4y ago
CVE-2022-23976	high	8.1/10	WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)	Apr 18, 2022 4y ago
CVE-2022-23975	medium	6.5/10	WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation	Apr 18, 2022 4y ago
CVE-2021-36828	medium	4.8/10	WordPress WP Maintenance plugin <= 6.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 15, 2022 4y ago
CVE-2021-36914	medium	6.1/10	WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)	Apr 12, 2022 4y ago