Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

344,220

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,621

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 361–390 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-57709	high	8.6/10	WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability	Jul 13, 2026 25d ago
CVE-2026-57708	high	7.1/10	WordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57707	critical	9.3/10	WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57706	high	7.1/10	WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57705	high	7.5/10	WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57702	critical	9.3/10	WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability	Jul 13, 2026 25d ago
CVE-2026-57698	medium	6.5/10	WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability	Jul 13, 2026 25d ago
CVE-2026-57697	high	7.5/10	WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability	Jul 13, 2026 25d ago
CVE-2026-57695	high	7.1/10	WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57694	medium	6.5/10	WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57693	medium	6.5/10	WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57691	medium	5.8/10	WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57668	high	7.1/10	WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57424	medium	6.5/10	WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57423	high	7.1/10	WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57422	high	7.1/10	WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57421	high	7.1/10	WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57420	medium	6.5/10	WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57419	medium	6.5/10	WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57418	medium	6.5/10	WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57417	high	7.1/10	WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57416	high	7.1/10	WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57415	high	7.1/10	WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57414	medium	6.5/10	WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57413	medium	6.4/10	WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57412	medium	6.5/10	WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability	Jul 13, 2026 25d ago
CVE-2026-57411	high	7.1/10	WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57410	high	8.8/10	WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability	Jul 13, 2026 25d ago
CVE-2026-57409	high	7.1/10	WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57408	medium	6.5/10	WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability	Jul 13, 2026 25d ago