Feed live

The CMS vulnerability ledger.

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,176

All time

Critical · Active

11,977

CVSS ≥ 9.0

New · 14 days

2,665

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 901–930 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-39594	medium	6.4/10	WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39591	critical	9.9/10	WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39587	high	8.1/10	WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39584	medium	6.5/10	WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39583	critical	9.8/10	WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39579	high	8.8/10	WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39540	medium	6.5/10	WordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39534	high	7.5/10	WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39533	high	7.5/10	WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39532	high	8.8/10	WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39530	critical	9.3/10	WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39527	medium	5.4/10	WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39525	medium	6.5/10	WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39524	high	7.5/10	WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39519	critical	9.3/10	WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39518	high	7.1/10	WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39515	medium	6.5/10	WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39514	high	7.1/10	WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39513	high	7.5/10	WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39512	critical	9.3/10	WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39511	critical	9.3/10	WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39507	high	7.1/10	WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39503	high	7.5/10	WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39502	critical	9.3/10	WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39499	high	7.2/10	WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39498	high	7.2/10	WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39493	critical	9.3/10	WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39492	critical	9.3/10	WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39491	medium	6.5/10	WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 2mo ago
CVE-2026-39489	medium	4.4/10	WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability	Jun 15, 2026 2mo ago