Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,835

All time

Critical · Active

12,642

CVSS ≥ 9.0

New · 14 days

1,511

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 301–330 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66466	high	7.5/10	WordPress StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66465	critical	9.8/10	WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66464	medium	6.5/10	WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66463	high	7.5/10	WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66462	high	7.5/10	WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66461	high	7.5/10	WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66460	medium	6.5/10	WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66459	medium	6.5/10	WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66458	critical	9.3/10	WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66456	medium	6.5/10	WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66455	medium	6.0/10	WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66454	medium	6.5/10	WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66453	critical	9.8/10	WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66450	high	8.1/10	WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66449	high	7.1/10	WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66446	critical	9.3/10	WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66444	medium	6.5/10	WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66443	high	7.5/10	WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66441	high	7.5/10	WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66436	critical	9.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66432	high	7.5/10	WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66431	high	7.5/10	WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66430	high	8.5/10	WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66429	high	7.1/10	WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66426	high	7.1/10	WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-66424	critical	9.8/10	WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability	Aug 13, 2026 2mo ago
CVE-2026-65582	high	7.7/10	WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability	Aug 13, 2026 2mo ago
CVE-2026-65580	high	7.1/10	WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61984	high	7.5/10	WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61980	high	7.5/10	WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability	Aug 13, 2026 2mo ago