Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,559

All time

Critical · Active

12,626

CVSS ≥ 9.0

New · 14 days

1,403

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17941–17970 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-25614	medium	4.3/10	WordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerability	Apr 11, 2022 4y ago
CVE-2022-25615	medium	4.3/10	WordPress eRoom plugin <= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache Deletion	Apr 11, 2022 4y ago
CVE-2021-36893	medium	4.8/10	WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36846	medium	4.8/10	WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36896	medium	4.8/10	WordPress Pricing Table plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36848	low	3.4/10	WordPress Social Media Feather plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36910	low	3.4/10	WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Apr 11, 2022 4y ago
CVE-2021-36826	medium	5.4/10	WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2021-36851	medium	4.1/10	WordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2022-25618	low	3.4/10	WordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2022-25613	medium	4.1/10	WordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability	Apr 4, 2022 4y ago
CVE-2022-0537	—	—	MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution	Apr 4, 2022 4y ago
CVE-2022-0770	—	—	Translate WordPress with GTranslate < 2.9.9 - CSRF to Account Takeover	Mar 28, 2022 4y ago
CVE-2021-24962	—	—	WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE	Mar 28, 2022 4y ago
CVE-2022-25612	medium	4.1/10	WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities	Mar 25, 2022 4y ago
CVE-2022-25611	medium	4.1/10	WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Mar 25, 2022 4y ago
CVE-2022-25610	low	3.4/10	WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Mar 25, 2022 4y ago
CVE-2022-25606	medium	4.8/10	WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Mar 25, 2022 4y ago
CVE-2022-25609	medium	5.4/10	WordPress Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerability	Mar 23, 2022 4y ago
CVE-2022-25608	medium	5.4/10	WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to slider Duplicate/Delete	Mar 23, 2022 4y ago
CVE-2022-25607	medium	6.6/10	WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability	Mar 18, 2022 4y ago
CVE-2022-25605	medium	4.8/10	WordPress WP-DownloadManager plugin <= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities	Mar 18, 2022 4y ago
CVE-2022-25602	high	8.3/10	WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability	Mar 18, 2022 4y ago
CVE-2022-25604	medium	4.1/10	WordPress Price Table plugin <= 0.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2021-23209	medium	4.8/10	WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities	Mar 18, 2022 4y ago
CVE-2021-23150	medium	4.8/10	WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2021-44760	medium	4.8/10	WordPress WP-DownloadManager plugin <= 1.68.6 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2022-25603	medium	4.8/10	WordPress MaxGalleria plugin <= 6.2.5 - Stored Cross-Site Scripting (XSS) vulnerability	Mar 18, 2022 4y ago
CVE-2022-0230	—	—	Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting	Mar 14, 2022 4y ago
CVE-2021-25026	—	—	Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting	Mar 14, 2022 4y ago