Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

344,220

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,622

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-57774	medium	5.3/10	WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57773	high	7.6/10	WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57772	high	8.5/10	WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57771	high	8.5/10	WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57770	critical	9.8/10	WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57768	high	8.2/10	WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability	Jul 13, 2026 25d ago
CVE-2026-57745	high	7.1/10	WordPress RT-Theme 18 \| Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57744	critical	9.8/10	WordPress RT-Theme 18 \| Extensions plugin <= 2.5 - PHP Object Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57743	high	8.1/10	WordPress RT-Theme 18 \| Extensions plugin <= 2.5 - Local File Inclusion vulnerability	Jul 13, 2026 25d ago
CVE-2026-57741	high	7.1/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57740	high	7.1/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57739	critical	9.3/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57738	critical	9.8/10	WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57734	high	7.1/10	WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57733	high	7.1/10	WordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57732	high	7.1/10	WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57729	high	7.5/10	WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57728	high	7.1/10	WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57727	high	7.5/10	WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57726	critical	9.3/10	WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57725	high	7.1/10	WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57724	critical	9.8/10	WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57719	critical	10.0/10	WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability	Jul 13, 2026 25d ago
CVE-2026-57718	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57715	high	7.1/10	WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57714	critical	9.3/10	WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57713	high	8.8/10	WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57712	high	7.1/10	WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57711	medium	6.5/10	WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57710	critical	9.9/10	WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability	Jul 13, 2026 25d ago