Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

339,761

All time

Critical · Active

10,860

CVSS ≥ 9.0

New · 14 days

2,607

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 451–480 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-39519	critical	9.3/10	WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39518	high	7.1/10	WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39515	medium	6.5/10	WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39514	high	7.1/10	WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39513	high	7.5/10	WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39512	critical	9.3/10	WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39511	critical	9.3/10	WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39507	high	7.1/10	WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39503	high	7.5/10	WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39502	critical	9.3/10	WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39499	high	7.2/10	WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39498	high	7.2/10	WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39493	critical	9.3/10	WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39492	critical	9.3/10	WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39491	medium	6.5/10	WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39489	medium	4.4/10	WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39481	high	7.2/10	WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39480	high	7.5/10	WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39478	high	8.8/10	WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39474	high	8.8/10	WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39472	high	7.2/10	WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39471	high	7.2/10	WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39470	high	7.2/10	WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39468	medium	6.8/10	WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39465	critical	9.1/10	WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39463	high	7.1/10	WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39451	medium	6.3/10	WordPress WP Google Review Slider plugin <= 18.0 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39450	high	7.1/10	WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39449	high	7.1/10	WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-39447	high	7.1/10	WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago