Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

350,227

All time

Critical · Active

12,289

CVSS ≥ 9.0

New · 14 days

1,728

Newly disclosed

Feed last synced

13 mins ago

Data freshness

Showing 17881–17910 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-21661	high	8.0/10	SQL injection in WordPress	Jan 6, 2022 4y ago
CVE-2021-36886	medium	6.5/10	WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability	Dec 22, 2021 4y ago
CVE-2021-36885	medium	6.1/10	WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Dec 22, 2021 4y ago
CVE-2021-36887	medium	6.1/10	WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)	Dec 20, 2021 4y ago
CVE-2021-36889	low	3.4/10	WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities	Dec 20, 2021 4y ago
CVE-2021-36888	critical	9.8/10	WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise	Dec 15, 2021 4y ago
CVE-2021-36911	medium	4.8/10	WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability	Dec 10, 2021 4y ago
CVE-2021-36919	medium	6.1/10	WordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities	Nov 26, 2021 4y ago
CVE-2021-36843	medium	4.8/10	WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Nov 26, 2021 4y ago
CVE-2021-36916	high	8.6/10	WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability	Nov 24, 2021 4y ago
CVE-2021-36917	medium	6.5/10	WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability	Nov 24, 2021 4y ago
CVE-2021-24875	—	—	eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting	Nov 23, 2021 4y ago
CVE-2021-36884	medium	4.8/10	WordPress Backup Migration plugin <= 1.1.5 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Nov 19, 2021 4y ago
CVE-2021-43408	medium	6.5/10	Duplicate Post WordPress Plugin SQL Injection Vulnerability	Nov 19, 2021 4y ago
CVE-2021-43409	critical	9.3/10	WPO365 \| LOGIN - Wordpress Plugin Persistent Cross-Site Scripting	Nov 19, 2021 4y ago
CVE-2021-36909	high	8.8/10	WordPress WP Reset PRO Premium plugin <= 5.98 - Authenticated Database Reset vulnerability	Nov 18, 2021 4y ago
CVE-2021-36908	high	8.8/10	WordPress WP Reset PRO Premium Plugin <= 5.98 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 18, 2021 4y ago
CVE-2021-42362	high	8.8/10	WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload	Nov 17, 2021 4y ago
CVE-2021-24594	—	—	Translate WordPress - Google Language Translator < 6.0.12 - Admin+ Stored Cross-Site Scripting	Nov 8, 2021 4y ago
CVE-2021-39340	medium	4.8/10	Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site Scripting	Nov 1, 2021 4y ago
CVE-2021-24773	—	—	WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting	Nov 1, 2021 4y ago
CVE-2021-26609	high	7.5/10	WordPress Mangboard SQL-Injection vulnerability	Oct 26, 2021 4y ago
CVE-2021-24744	—	—	WordPress Contact Forms by Cimatti < 1.4.12 - Admin+ Stored Cross-Site Scripting	Oct 25, 2021 4y ago
CVE-2021-24544	—	—	Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting	Oct 25, 2021 4y ago
CVE-2021-36869	medium	4.8/10	WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability	Oct 21, 2021 4y ago
CVE-2021-39348	medium	5.5/10	LearnPress – WordPress LMS Plugin <= 4.1.3.1 Authenticated Stored Cross-Site Scripting	Oct 21, 2021 4y ago
CVE-2021-36832	medium	4.8/10	WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Oct 19, 2021 4y ago
CVE-2021-39332	medium	5.5/10	Business Manager – WordPress ERP, HR, CRM, and Project Management Plugin <= 1.4.5 Authenticated Stored Cross-Site Scripting	Oct 15, 2021 4y ago
CVE-2021-24712	—	—	Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSS	Oct 11, 2021 4y ago
CVE-2021-36850	medium	5.4/10	WordPress Media File Renamer – Auto & Manual Rename plugin <= 5.1.9 - Cross-Site Request Forgery (CSRF) vulnerability	Oct 4, 2021 4y ago