Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,837

All time

Critical · Active

12,642

CVSS ≥ 9.0

New · 14 days

1,496

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 451–480 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-28180	medium	5.3/10	WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28179	medium	5.9/10	WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28178	medium	6.5/10	WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28177	high	7.1/10	WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28172	high	7.1/10	WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28169	medium	5.3/10	WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28146	medium	6.5/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28143	high	7.1/10	WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28141	high	7.1/10	WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28140	high	7.5/10	WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28139	critical	9.8/10	WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28111	high	8.8/10	WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28082	high	7.1/10	WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28005	critical	9.8/10	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability	Aug 6, 2026 2mo ago
CVE-2026-25403	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-66712	high	7.5/10	WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2025-15028	high	7.2/10	FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting	Aug 6, 2026 2mo ago
CVE-2026-28147	medium	5.4/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability	Aug 3, 2026 2mo ago
CVE-2026-28144	medium	4.3/10	WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability	Jul 31, 2026 2mo ago
CVE-2026-28145	medium	5.3/10	WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability	Jul 31, 2026 2mo ago
CVE-2026-14834	—	—	Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX	Jul 31, 2026 2mo ago
CVE-2026-5060	medium	6.5/10	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion	Jul 29, 2026 2mo ago
CVE-2026-14234	—	—	WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF	Jul 29, 2026 2mo ago
CVE-2026-45293	high	8.6/10	WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability	Jul 28, 2026 2mo ago
CVE-2026-65447	high	7.1/10	WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 2mo ago
CVE-2026-65446	high	7.1/10	WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 2mo ago
CVE-2026-65445	medium	6.5/10	WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability	Jul 27, 2026 2mo ago
CVE-2026-65440	high	7.1/10	WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 2mo ago
CVE-2026-65439	high	7.1/10	WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 2mo ago
CVE-2026-65438	high	7.1/10	WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 2mo ago