Feed live

The CMS vulnerability ledger.

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,115

All time

Critical · Active

11,964

CVSS ≥ 9.0

New · 14 days

2,720

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 121–150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-61969	critical	9.3/10	WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-61967	critical	9.8/10	WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability	Aug 13, 2026 10d ago
CVE-2026-61966	critical	9.3/10	WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-61965	high	7.1/10	WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 10d ago
CVE-2026-61962	critical	10.0/10	WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability	Aug 13, 2026 10d ago
CVE-2026-61960	high	7.1/10	WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 10d ago
CVE-2026-28189	high	7.4/10	WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability	Aug 13, 2026 10d ago
CVE-2026-28188	high	7.3/10	WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability	Aug 13, 2026 10d ago
CVE-2026-28187	high	7.1/10	WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 10d ago
CVE-2026-28186	high	8.1/10	WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability	Aug 13, 2026 10d ago
CVE-2026-28185	critical	9.8/10	WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability	Aug 13, 2026 10d ago
CVE-2026-28184	high	8.5/10	WordPress Form Maker by 10Web plugin <= 1.15.44 - SQL Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-28182	medium	6.5/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 10d ago
CVE-2026-28181	medium	6.5/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability	Aug 13, 2026 10d ago
CVE-2026-28176	high	8.8/10	WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-28175	high	7.1/10	WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 10d ago
CVE-2026-28174	medium	6.5/10	WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability	Aug 13, 2026 10d ago
CVE-2026-28173	high	7.1/10	WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability	Aug 13, 2026 10d ago
CVE-2026-28170	high	7.1/10	WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 10d ago
CVE-2026-28168	high	8.5/10	WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-28161	high	8.8/10	WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability	Aug 13, 2026 10d ago
CVE-2026-28159	medium	6.5/10	WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability	Aug 13, 2026 10d ago
CVE-2026-28158	high	7.1/10	WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 10d ago
CVE-2026-28157	high	7.5/10	WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability	Aug 13, 2026 10d ago
CVE-2026-28156	high	8.5/10	WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-28155	medium	6.5/10	WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability	Aug 13, 2026 10d ago
CVE-2026-28149	critical	9.8/10	WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-28148	critical	9.8/10	WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability	Aug 13, 2026 10d ago
CVE-2026-28142	critical	9.3/10	WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability	Aug 13, 2026 10d ago
CVE-2026-28008	critical	9.8/10	WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability	Aug 13, 2026 10d ago