Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,555

All time

Critical · Active

12,625

CVSS ≥ 9.0

New · 14 days

1,399

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17881–17910 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-29437	medium	5.4/10	WordPress Image Slider by NextCode plugin <= 1.1.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Jun 15, 2022 4y ago
CVE-2022-29406	medium	4.1/10	WordPress Team Manager plugin <= 1.6.9 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Jun 15, 2022 4y ago
CVE-2021-36901	medium	6.1/10	WordPress Age Gate plugin <= 2.17.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Jun 15, 2022 4y ago
CVE-2022-29455	medium	4.7/10	WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability	Jun 13, 2022 4y ago
CVE-2022-1961	medium	5.5/10	Google Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element ID	Jun 13, 2022 4y ago
CVE-2022-1707	medium	6.1/10	Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search	Jun 13, 2022 4y ago
CVE-2022-1800	—	—	Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection	Jun 13, 2022 4y ago
CVE-2022-1780	—	—	LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS	Jun 13, 2022 4y ago
CVE-2022-1712	—	—	LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRF	Jun 6, 2022 4y ago
CVE-2022-1577	—	—	Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF	Jun 6, 2022 4y ago
CVE-2022-1569	—	—	WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting	Jun 6, 2022 4y ago
CVE-2021-36890	medium	4.3/10	WordPress Social Share Buttons by Supsystic plugin <= 2.2.2 - Cross-Site Request Forgery (CSRF) vulnerability	May 31, 2022 4y ago
CVE-2021-36866	medium	4.8/10	WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	May 31, 2022 4y ago
CVE-2022-29408	medium	4.7/10	WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability	May 25, 2022 4y ago
CVE-2022-29432	low	3.4/10	WordPress wpDataTables plugin <= 2.1.27 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	May 20, 2022 4y ago
CVE-2022-29430	medium	4.7/10	WordPress PNG to JPG plugin <= 4.0 - Cross-Site Request Forgery (CSRF) leading to Persistent Cross-Site Scripting (XSS) vulnerability	May 20, 2022 4y ago
CVE-2022-29428	medium	4.1/10	WordPress WP Slider Plugin <= 1.4.5 - Cross-Site Scripting (XSS) vulnerability	May 20, 2022 4y ago
CVE-2022-29434	medium	6.3/10	WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability	May 20, 2022 4y ago
CVE-2022-29447	medium	6.8/10	WordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerability	May 20, 2022 4y ago
CVE-2022-29427	medium	4.3/10	WordPress Disable Right Click For WP plugin <= 1.1.6 - Cross-Site Request Forgery (CSRF) vulnerability	May 20, 2022 4y ago
CVE-2022-29426	medium	5.4/10	WordPress Slideshow, Image Slider by 2J plugin <= 1.3.54 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	May 20, 2022 4y ago
CVE-2022-29448	medium	6.8/10	WordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerability	May 20, 2022 4y ago
CVE-2022-29425	medium	6.1/10	WordPress Checkout Files Upload for WooCommerce plugin <= 2.1.2 - Cross-Site Scripting (XSS) vulnerability	May 20, 2022 4y ago
CVE-2022-29424	medium	4.8/10	WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	May 20, 2022 4y ago
CVE-2021-36833	medium	4.8/10	WordPress MC4WP plugin <= 4.8.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	May 20, 2022 4y ago
CVE-2022-29449	medium	4.1/10	WordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerability	May 19, 2022 4y ago
CVE-2022-29446	medium	6.8/10	WordPress Counter Box plugin <= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerability	May 19, 2022 4y ago
CVE-2022-25617	medium	4.7/10	WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability	May 18, 2022 4y ago
CVE-2022-29445	medium	6.8/10	WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability	May 18, 2022 4y ago
CVE-2022-29435	medium	5.4/10	WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability	May 17, 2022 4y ago