Feed live

The CMS vulnerability ledger.

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

349,463

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,093

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 12481–12510 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-9049	medium	6.4/10	Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module	Sep 27, 2024 1y ago
CVE-2024-8771	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure	Sep 26, 2024 1y ago
CVE-2022-4541	high	7.2/10	WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header	Sep 26, 2024 1y ago
CVE-2024-47337	medium	4.3/10	WordPress Joy Of Text Lite plugin <= 2.3.1 - Broken Access Control vulnerability	Sep 26, 2024 1y ago
CVE-2024-47330	medium	4.3/10	Broken Access Control vulnerability on multiple WordPress plugins by Supsystic	Sep 26, 2024 1y ago
CVE-2024-47305	medium	4.3/10	WordPress Use Any Font plugin <= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerability	Sep 25, 2024 1y ago
CVE-2024-47315	medium	5.4/10	WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability	Sep 25, 2024 1y ago
CVE-2024-43237	medium	5.3/10	WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerability	Sep 25, 2024 1y ago
CVE-2024-43990	medium	5.3/10	WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability	Sep 25, 2024 1y ago
CVE-2024-43959	high	7.1/10	WordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 25, 2024 1y ago
CVE-2024-47303	medium	6.5/10	WordPress Elementor Addons by Livemesh plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability	Sep 25, 2024 1y ago
CVE-2024-8658	medium	5.3/10	myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade	Sep 25, 2024 1y ago
CVE-2024-7385	critical	9.1/10	WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection	Sep 25, 2024 1y ago
CVE-2024-9073	medium	6.4/10	GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	Sep 25, 2024 1y ago
CVE-2024-8434	medium	4.3/10	Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates	Sep 25, 2024 1y ago
CVE-2024-9069	medium	6.4/10	Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	Sep 25, 2024 1y ago
CVE-2024-8436	critical	9.9/10	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection	Sep 24, 2024 1y ago
CVE-2024-8437	medium	4.3/10	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation	Sep 24, 2024 1y ago
CVE-2024-8267	medium	6.4/10	Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	Sep 24, 2024 1y ago
CVE-2024-8791	critical	9.8/10	Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation	Sep 24, 2024 1y ago
CVE-2024-45453	low	3.7/10	WordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability	Sep 23, 2024 1y ago
CVE-2024-44048	medium	6.5/10	WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability	Sep 23, 2024 1y ago
CVE-2024-43996	medium	6.5/10	WordPress ElementsKit Pro plugin <= 3.6.0 - Local File Inclusion vulnerability	Sep 23, 2024 1y ago
CVE-2024-43989	high	7.5/10	WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability	Sep 22, 2024 1y ago
CVE-2024-8680	medium	4.4/10	MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting	Sep 21, 2024 1y ago
CVE-2024-8850	medium	6.1/10	MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting	Sep 19, 2024 1y ago
CVE-2024-43970	high	7.1/10	WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago
CVE-2024-43971	high	7.1/10	WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago
CVE-2024-43972	medium	5.9/10	WordPress Page Builder: Pagelayer – Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago
CVE-2024-43975	high	7.1/10	WordPress Super Store Finder plugin <= 6.9.7 - Cross Site Scripting (XSS) vulnerability	Sep 17, 2024 1y ago