Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

702

Newly disclosed

Feed last synced

17 hrs ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42678	high	7.1/10	WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2026 26d ago
CVE-2026-42679	medium	6.5/10	WordPress Classified Listing plugin <= 5.3.8 - Arbitrary File Download vulnerability	Jun 1, 2026 26d ago
CVE-2026-42680	critical	9.8/10	WordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability	Jun 1, 2026 26d ago
CVE-2026-42681	high	7.1/10	WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 1, 2026 26d ago
CVE-2026-42682	critical	9.1/10	WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability	Jun 1, 2026 26d ago
CVE-2026-42683	high	7.1/10	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2026 26d ago
CVE-2026-48839	high	7.1/10	WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability	Jun 1, 2026 26d ago
CVE-2026-48865	high	7.1/10	WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 1, 2026 26d ago
CVE-2026-48866	critical	9.6/10	WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability	Jun 1, 2026 26d ago
CVE-2026-48879	critical	9.8/10	WordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability	Jun 1, 2026 26d ago
CVE-2026-7459	high	7.5/10	Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint	May 30, 2026 28d ago
CVE-2025-14042	medium	6.4/10	Automotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details	May 29, 2026 29d ago
CVE-2026-8689	medium	4.3/10	Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions	May 28, 2026 1mo ago
CVE-2026-7621	medium	4.3/10	SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate	May 28, 2026 1mo ago
CVE-2022-41656	medium	4.3/10	WordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49054	medium	4.3/10	WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49053	medium	5.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49052	medium	4.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49051	medium	4.3/10	WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49047	medium	4.3/10	WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49046	high	8.5/10	WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability	May 27, 2026 1mo ago
CVE-2026-49044	medium	6.5/10	WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-49045	medium	4.3/10	WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49059	medium	4.7/10	WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability	May 27, 2026 1mo ago
CVE-2026-48973	medium	4.3/10	WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-48972	high	7.5/10	WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability	May 27, 2026 1mo ago
CVE-2026-48971	medium	4.3/10	WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-42762	high	7.1/10	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-42761	critical	9.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability	May 27, 2026 1mo ago
CVE-2026-42760	high	7.5/10	WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability	May 27, 2026 1mo ago