Common Weakness Enumeration — the root causes behind every CVE

Weakness classes, not one-off bugs

What is CWE?

CWE (Common Weakness Enumeration) is MITRE's taxonomy of software weakness types — the underlying coding and design mistakes that make vulnerabilities possible in the first place. Where a CVE documents one specific, dated flaw in one specific product, a CWE names the pattern behind it: the category of mistake that keeps producing new CVEs across completely unrelated codebases.

Path traversal, SQL injection, missing authorization, cross-site scripting — these are CWE categories, not individual bugs. A single CWE can sit behind hundreds of CVEs spread across WordPress plugins, Joomla extensions, and Drupal modules that have never shared a line of code, because the same mistake gets made independently, over and over.

CWE vs. CVE — the difference that actually matters

CVE is the instance. CWE is the class. CVE-2026-40722 is "an unauthenticated path traversal flaw in one plugin, versions 1.0 through 1.4.2." CWE-22 is "Path Traversal" — the weakness class that flaw belongs to, shared with hundreds of unrelated CVEs.

Knowing the CWE behind a CVE tells you why it happened, not just what it affects. That's useful in two different ways depending on who's reading: a site owner gets a faster gut-check on how serious a class of bug typically is, and a developer gets the actual pattern to avoid repeating in their own code — not just one patched instance of it.

How we use it

How we use CWE here

Every CVE in our vulnerability database is mapped to its CWE classification. Each writeup below explains the weakness in plain language, shows the vulnerable and corrected code pattern side by side in both Python and PHP, and links out to real CVEs from our database that trace back to that exact weakness — so the pattern is grounded in actual disclosed vulnerabilities, not just described in the abstract.

Where these weaknesses show up most in CMS software

A small number of CWE categories account for a disproportionate share of WordPress, Joomla, and Drupal plugin vulnerabilities:

• CWE-79 Cross-Site Scripting (XSS)
• CWE-89 SQL Injection
• CWE-22 Path Traversal
• CWE-862 Missing Authorization
• CWE-352 Cross-Site Request Forgery (CSRF)
• CWE-434 Unrestricted File Upload

If you build or maintain plugins, themes, or extensions, these are the categories worth reviewing first in your own code — they represent the majority of disclosed CMS vulnerabilities year after year, across every platform we track.