Feed live

The CMS vulnerability ledger.

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

341,754

All time

Critical · Active

11,126

CVSS ≥ 9.0

New · 14 days

3,178

Newly disclosed

Feed last synced

42 mins ago

Data freshness

Showing 5791–5820 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-52827	high	8.8/10	WordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-52834	critical	9.3/10	WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability	Jun 27, 2025 1y ago
CVE-2025-52829	critical	9.3/10	WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2023-25998	high	8.1/10	WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-23973	high	7.1/10	WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-23967	critical	9.3/10	WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-49416	high	8.1/10	WordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-24760	high	8.1/10	WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-49423	high	7.1/10	WordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-49448	high	8.6/10	WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Deletion Vulnerability	Jun 27, 2025 1y ago
CVE-2024-12827	critical	9.8/10	DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset	Jun 27, 2025 1y ago
CVE-2025-4587	medium	6.4/10	A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2025 1y ago
CVE-2025-5143	medium	6.4/10	TableOn – WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode	Jun 21, 2025 1y ago
CVE-2025-49873	high	7.1/10	WordPress Elessi theme <= 6.3.9 - Cross Site Scripting (XSS) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49964	medium	4.3/10	WordPress ClipLink plugin <= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49966	medium	4.3/10	WordPress Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49965	medium	4.3/10	WordPress PixelBeds Channel Manager and Hotel Booking Engine plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49968	medium	4.3/10	WordPress XML Travel Portal Widget plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49967	medium	4.3/10	WordPress Live Sports Streamthunder plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49969	medium	4.3/10	WordPress Zara 4 Image Compression plugin <= 1.2.17.2 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49970	medium	4.3/10	WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49971	medium	4.3/10	WordPress eDS Responsive Menu plugin <= 1.2 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49973	medium	4.3/10	WordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin <= 1.0.10 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49972	medium	4.3/10	WordPress TM Replace Howdy plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49974	medium	4.3/10	WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49976	medium	4.3/10	WordPress WANotifier plugin <= 2.7.12 - Broken Access Control vulnerability	Jun 20, 2025 1y ago
CVE-2025-49975	medium	4.3/10	WordPress JobWP plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49978	medium	4.3/10	WordPress JobSearch plugin < 3.0.6 - Insecure Direct Object References (IDOR) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-49977	medium	4.3/10	WordPress WP Inventory Manager plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability	Jun 20, 2025 1y ago
CVE-2025-49980	medium	4.3/10	WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago