Feed live

The CMS vulnerability ledger.

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

343,699

All time

Critical · Active

11,479

CVSS ≥ 9.0

New · 14 days

2,537

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 12151–12180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-8254	medium	5.4/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution	Oct 2, 2024 1y ago
CVE-2024-9289	critical	9.8/10	WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation	Oct 1, 2024 1y ago
CVE-2024-8288	medium	6.4/10	Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Oct 1, 2024 1y ago
CVE-2024-9267	medium	6.1/10	Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter	Oct 1, 2024 1y ago
CVE-2024-8632	medium	6.5/10	KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure	Oct 1, 2024 1y ago
CVE-2024-8548	high	8.1/10	KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions	Oct 1, 2024 1y ago
CVE-2024-47396	medium	6.5/10	WordPress Move Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2024 1y ago
CVE-2024-47641	medium	6.5/10	WordPress Confetti Fall Animation plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Sep 30, 2024 1y ago
CVE-2024-9049	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module	Sep 27, 2024 1y ago
CVE-2024-8771	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure	Sep 26, 2024 1y ago
CVE-2022-4541	high	7.2/10	WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header	Sep 26, 2024 1y ago
CVE-2024-47337	medium	4.3/10	WordPress Joy Of Text Lite plugin <= 2.3.1 - Broken Access Control vulnerability	Sep 26, 2024 1y ago
CVE-2024-47330	medium	4.3/10	Broken Access Control vulnerability on multiple WordPress plugins by Supsystic	Sep 26, 2024 1y ago
CVE-2024-47305	medium	4.3/10	WordPress Use Any Font plugin <= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerability	Sep 25, 2024 1y ago
CVE-2024-47315	medium	5.4/10	WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability	Sep 25, 2024 1y ago
CVE-2024-43237	medium	5.3/10	WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerability	Sep 25, 2024 1y ago
CVE-2024-43990	medium	5.3/10	WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability	Sep 25, 2024 1y ago
CVE-2024-43959	high	7.1/10	WordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 25, 2024 1y ago
CVE-2024-47303	medium	6.5/10	WordPress Elementor Addons by Livemesh plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability	Sep 25, 2024 1y ago
CVE-2024-8658	medium	5.3/10	myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade	Sep 25, 2024 1y ago
CVE-2024-7385	critical	9.1/10	WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection	Sep 25, 2024 1y ago
CVE-2024-9073	medium	6.4/10	GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	Sep 25, 2024 1y ago
CVE-2024-8434	medium	4.3/10	Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates	Sep 25, 2024 1y ago
CVE-2024-9069	medium	6.4/10	Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	Sep 25, 2024 1y ago
CVE-2024-8436	critical	9.9/10	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection	Sep 24, 2024 1y ago
CVE-2024-8437	medium	4.3/10	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation	Sep 24, 2024 1y ago
CVE-2024-8267	medium	6.4/10	Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Sep 24, 2024 1y ago
CVE-2024-8791	critical	9.8/10	Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation	Sep 24, 2024 1y ago
CVE-2024-45453	low	3.7/10	WordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability	Sep 23, 2024 1y ago
CVE-2024-44048	medium	6.5/10	WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability	Sep 23, 2024 1y ago