Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

700

Newly disclosed

Feed last synced

19 hrs ago

Data freshness

Showing 391–420 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42726	medium	6.5/10	WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-48968	medium	6.5/10	WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-48877	medium	6.5/10	WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability	May 27, 2026 1mo ago
CVE-2025-52747	high	7.1/10	WordPress Themebox - Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2025-22741	high	7.1/10	WordPress Felan Framework plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-8943	medium	4.3/10	GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function	May 27, 2026 1mo ago
CVE-2025-14361	high	7.1/10	WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerability	May 26, 2026 1mo ago
CVE-2026-25426	medium	5.3/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability	May 26, 2026 1mo ago
CVE-2026-24520	medium	4.3/10	WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability	May 26, 2026 1mo ago
CVE-2026-25444	medium	4.3/10	WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability	May 26, 2026 1mo ago
CVE-2026-27331	medium	6.3/10	WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability	May 26, 2026 1mo ago
CVE-2026-24590	medium	5.3/10	WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability	May 26, 2026 1mo ago
CVE-2026-24638	medium	4.3/10	WordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability	May 26, 2026 1mo ago
CVE-2026-27427	medium	6.5/10	WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability	May 26, 2026 1mo ago
CVE-2026-39642	medium	5.3/10	WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability	May 26, 2026 1mo ago
CVE-2026-39661	high	7.5/10	WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability	May 26, 2026 1mo ago
CVE-2026-39655	medium	5.3/10	WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability	May 26, 2026 1mo ago
CVE-2026-32389	medium	5.4/10	WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability	May 25, 2026 1mo ago
CVE-2026-42763	medium	6.5/10	WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability	May 25, 2026 1mo ago
CVE-2026-42773	critical	9.3/10	WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability	May 25, 2026 1mo ago
CVE-2026-42774	critical	9.3/10	WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability	May 25, 2026 1mo ago
CVE-2026-42776	medium	6.3/10	WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability	May 25, 2026 1mo ago
CVE-2026-45209	high	7.5/10	WordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability	May 25, 2026 1mo ago
CVE-2026-45216	high	8.8/10	WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability	May 25, 2026 1mo ago
CVE-2026-45217	medium	6.5/10	WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability	May 25, 2026 1mo ago
CVE-2026-45435	medium	6.5/10	WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability	May 25, 2026 1mo ago
CVE-2026-45438	high	7.5/10	WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability	May 25, 2026 1mo ago
CVE-2026-39436	high	7.1/10	WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability	May 25, 2026 1mo ago
CVE-2026-24937	high	7.2/10	WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability	May 25, 2026 1mo ago
CVE-2026-48837	high	8.5/10	WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability	May 25, 2026 1mo ago