Feed live

The CMS vulnerability ledger.

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,123

All time

Critical · Active

11,966

CVSS ≥ 9.0

New · 14 days

2,726

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 241–270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-28177	high	7.1/10	WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 17d ago
CVE-2026-28172	high	7.1/10	WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability	Aug 6, 2026 17d ago
CVE-2026-28169	medium	5.3/10	WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability	Aug 6, 2026 17d ago
CVE-2026-28146	medium	6.5/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability	Aug 6, 2026 17d ago
CVE-2026-28143	high	7.1/10	WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 17d ago
CVE-2026-28141	high	7.1/10	WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 17d ago
CVE-2026-28140	high	7.5/10	WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability	Aug 6, 2026 17d ago
CVE-2026-28139	critical	9.8/10	WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability	Aug 6, 2026 17d ago
CVE-2026-28111	high	8.8/10	WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability	Aug 6, 2026 17d ago
CVE-2026-28082	high	7.1/10	WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 17d ago
CVE-2026-28005	critical	9.8/10	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability	Aug 6, 2026 17d ago
CVE-2026-25403	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability	Aug 6, 2026 17d ago
CVE-2026-66712	high	7.5/10	WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability	Aug 6, 2026 17d ago
CVE-2025-15028	high	7.2/10	FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting	Aug 6, 2026 17d ago
CVE-2026-28147	medium	5.4/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability	Aug 3, 2026 20d ago
CVE-2026-28144	medium	4.3/10	WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability	Jul 31, 2026 23d ago
CVE-2026-28145	medium	5.3/10	WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability	Jul 31, 2026 23d ago
CVE-2026-14834	—	—	Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX	Jul 31, 2026 23d ago
CVE-2026-5060	medium	6.5/10	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion	Jul 29, 2026 25d ago
CVE-2026-14234	—	—	WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF	Jul 29, 2026 25d ago
CVE-2026-45293	high	8.6/10	WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability	Jul 28, 2026 26d ago
CVE-2026-65447	high	7.1/10	WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago
CVE-2026-65446	high	7.1/10	WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago
CVE-2026-65445	medium	6.5/10	WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability	Jul 27, 2026 27d ago
CVE-2026-65440	high	7.1/10	WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago
CVE-2026-65439	high	7.1/10	WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago
CVE-2026-65438	high	7.1/10	WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago
CVE-2026-66448	medium	6.5/10	WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago
CVE-2026-66445	medium	6.5/10	WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago
CVE-2026-66433	medium	6.5/10	WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 27d ago