Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,836

All time

Critical · Active

12,642

CVSS ≥ 9.0

New · 14 days

1,496

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 391–420 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66688	medium	6.5/10	WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66686	medium	6.5/10	WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66685	medium	5.3/10	WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66683	medium	5.3/10	WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66681	medium	4.3/10	WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66678	medium	4.3/10	WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66665	critical	10.0/10	WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66663	high	7.1/10	WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66662	critical	9.8/10	WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66470	high	7.1/10	WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66457	high	7.1/10	WordPress Events Manager plugin <= 7.4.1 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66451	medium	6.5/10	WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66447	critical	9.3/10	WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66440	high	7.1/10	WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66439	high	7.1/10	WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65581	critical	9.8/10	WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65579	critical	9.8/10	WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65578	critical	9.8/10	WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65577	critical	9.8/10	WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65576	critical	9.8/10	WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65575	critical	9.8/10	WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65574	critical	9.8/10	WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65573	critical	9.8/10	WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65572	critical	9.8/10	WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65571	critical	9.8/10	WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65570	high	8.1/10	WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65569	high	8.5/10	WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65565	high	7.1/10	WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65560	high	7.1/10	WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65559	high	7.2/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability	Aug 6, 2026 2mo ago