Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,835

All time

Critical · Active

12,642

CVSS ≥ 9.0

New · 14 days

1,495

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-61979	high	8.1/10	WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61978	medium	6.5/10	WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61974	high	7.1/10	WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61969	critical	9.3/10	WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61967	critical	9.8/10	WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61966	critical	9.3/10	WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61965	high	7.1/10	WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61962	critical	10.0/10	WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability	Aug 13, 2026 2mo ago
CVE-2026-61960	high	7.1/10	WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28189	high	7.4/10	WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28188	high	7.3/10	WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28187	high	7.1/10	WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28186	high	8.1/10	WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28185	critical	9.8/10	WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28184	high	8.5/10	WordPress Form Maker by 10Web plugin <= 1.15.44 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28182	medium	6.5/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28181	medium	6.5/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28176	high	8.8/10	WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28175	high	7.1/10	WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28174	medium	6.5/10	WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28173	high	7.1/10	WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28170	high	7.1/10	WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28168	high	8.5/10	WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28161	high	8.8/10	WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28159	medium	6.5/10	WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28158	high	7.1/10	WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28157	high	7.5/10	WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28156	high	8.5/10	WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28155	medium	6.5/10	WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability	Aug 13, 2026 2mo ago
CVE-2026-28149	critical	9.8/10	WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability	Aug 13, 2026 2mo ago