What is a CVE?

A CVE is a unique public identifier for a specific, known security vulnerability. The letters stand for Common Vulnerabilities and Exposures, and the system gives every disclosed flaw a permanent reference such as CVE-2024-12345. When a plugin, theme, library or piece of server software is found to have a security weakness, it is assigned a CVE so that everyone, from researchers to the tools that scan your website, can refer to exactly the same issue without ambiguity.

What is a CVE and why does it matter?

Before the CVE system existed, two security tools might describe the same vulnerability in completely different ways, making it impossible to tell whether they meant the same problem. A CVE solves that by acting as a common language. When your scanner reports that a component on your site is affected by a particular CVE, you can look up that exact identifier in any vulnerability database and find the same authoritative description, affected versions and fix. It turns a vague warning into a precise, actionable fact.

How the CVE system works

The CVE program is coordinated by MITRE and sponsored by the United States cybersecurity agency, CISA. Vulnerabilities are assigned identifiers by organisations called CVE Numbering Authorities, which include many major software vendors. Once assigned, a CVE is usually enriched by the National Vulnerability Database, which adds a severity score, technical details and a list of affected products. This division of labour keeps the identifiers consistent while letting specialists add depth.

What a CVE entry contains

• The identifier, in the form CVE followed by the year and a sequence number.
• A description of the vulnerability and how it can be exploited.
• Affected products and versions, so you can tell whether you are exposed.
• References to advisories, patches and further analysis.

CVE versus CVSS

People often confuse the two. A CVE is the name of a vulnerability; CVSS is the score that tells you how severe it is. Every CVE can carry a CVSS rating from low to critical, which helps you decide what to fix first. Our guide on what CVSS is explains how that score is calculated. A related idea is the CISA catalogue of vulnerabilities known to be under active attack, covered in what a CISA KEV vulnerability is.

Why CVEs matter for your website

Most websites are built from many third-party parts, and any of them can pick up a CVE at any time. A plugin you installed two years ago may today have a critical CVE with a public exploit. This is why keeping software updated matters so much: patches exist precisely to close known CVEs. Our article on WordPress plugin and theme vulnerabilities shows how these flaws reach ordinary sites, and our vulnerability database lets you look them up.

How quickly should you fix a CVE?

It depends on the severity and, crucially, on whether the flaw is being exploited in the wild. A low-severity CVE in a component that is not exposed to the internet can often wait for your normal update cycle. A critical CVE in a plugin that faces the public web, especially one with a published exploit, should be treated as an emergency and patched the same day. The most dangerous CVEs of all are those on the actively-exploited list maintained by CISA, because attackers are already using them at scale against any unpatched site they can find. A practical policy for a small site is simple: apply security updates promptly rather than deferring them, prioritise anything rated high or critical, and treat a CVE that is known to be exploited as a drop-everything task. Automated scanning helps enormously here, because it turns the abstract question of which CVEs matter into a ranked list tied to the exact software you actually run.

How to check your site for known CVEs

You cannot patch what you do not know about, and manually tracking CVEs across every component is impractical. Run a security scan with EzyAudit AI and we will match the software on your site against known CVEs, tell you which affect you, and rank them by severity so you fix the most dangerous first. Review the full list of checks we run. For the authoritative record of every identifier, the official program is at cve.org.

Understanding what a CVE is turns a scary list of codes into a clear to-do list of fixes ranked by risk. Scan your website now to see which known CVEs affect your site today.