Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,559

All time

Critical · Active

12,626

CVSS ≥ 9.0

New · 14 days

1,403

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17971–18000 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-25600	medium	5.4/10	WordPress WP Google Map plugin <= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerability	Mar 11, 2022 4y ago
CVE-2022-25601	medium	4.7/10	WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability	Mar 11, 2022 4y ago
CVE-2022-0445	—	—	WordPress Real Cookie Banner < 2.14.2 - Settings Reset via CSRF	Mar 7, 2022 4y ago
CVE-2021-25087	—	—	Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure	Mar 7, 2022 4y ago
CVE-2021-24961	—	—	WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode	Mar 7, 2022 4y ago
CVE-2021-24960	—	—	WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG	Mar 7, 2022 4y ago
CVE-2021-26256	medium	4.7/10	WordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	Feb 21, 2022 4y ago
CVE-2022-25599	medium	5.4/10	WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability	Feb 21, 2022 4y ago
CVE-2022-23984	low	3.7/10	WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure	Feb 21, 2022 4y ago
CVE-2022-23983	medium	4.3/10	WordPress WP Content Copy Protection & No Right Click plugin <= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerability	Feb 21, 2022 4y ago
CVE-2022-0255	—	—	Database Backup for WordPress < 2.5.1 - Admin+ SQL Injection	Feb 21, 2022 4y ago
CVE-2021-25069	—	—	WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS	Feb 21, 2022 4y ago
CVE-2021-25055	—	—	FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)	Feb 21, 2022 4y ago
CVE-2022-23982	medium	4.3/10	WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Server Information Exposure vulnerability	Feb 18, 2022 4y ago
CVE-2022-23981	medium	4.3/10	WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability	Feb 18, 2022 4y ago
CVE-2022-0208	—	—	MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting	Feb 14, 2022 4y ago
CVE-2022-23980	medium	4.7/10	WordPress Yasr – Yet Another Stars Rating plugin <= 2.9.9 - Cross-Site Scripting (XSS) vulnerability	Feb 4, 2022 4y ago
CVE-2021-44779	high	7.3/10	WordPress [GWA] AutoResponder plugin <= 2.3 - Unauthenticated SQL Injection (SQLi) vulnerability	Feb 4, 2022 4y ago
CVE-2022-0220	—	—	WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting	Feb 1, 2022 4y ago
CVE-2021-24814	—	—	WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting	Feb 1, 2022 4y ago
CVE-2022-23979	medium	4.8/10	WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	Jan 28, 2022 4y ago
CVE-2021-31567	medium	6.8/10	WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability	Jan 28, 2022 4y ago
CVE-2021-23174	low	3.4/10	WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Jan 28, 2022 4y ago
CVE-2021-45729	medium	5.4/10	WordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerability	Jan 25, 2022 4y ago
CVE-2021-44777	medium	5.4/10	WordPress Email Tracker plugin <= 5.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion	Jan 19, 2022 4y ago
CVE-2021-36920	medium	4.8/10	WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	Jan 14, 2022 4y ago
CVE-2021-23227	medium	5.4/10	WordPress PHP Everywhere Plugin <= 2.0.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 13, 2022 4y ago
CVE-2022-21662	high	8.0/10	Stored XSS in WordPress	Jan 6, 2022 4y ago
CVE-2022-21663	medium	6.6/10	Authenticated Object Injection in Multisites in WordPress	Jan 6, 2022 4y ago
CVE-2022-21664	high	7.4/10	SQL injection in WordPress	Jan 6, 2022 4y ago