Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

339,774

All time

Critical · Active

10,860

CVSS ≥ 9.0

New · 14 days

2,602

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 511–540 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-48969	medium	6.5/10	WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49111	high	8.8/10	WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49062	high	8.8/10	WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability	Jun 15, 2026 1mo ago
CVE-2026-52704	critical	10.0/10	WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability	Jun 15, 2026 1mo ago
CVE-2016-20068	high	8.8/10	WordPress Booking Calendar Contact Form 1.0.23 SQL Injection	Jun 15, 2026 1mo ago
CVE-2019-25746	high	7.1/10	WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter	Jun 15, 2026 1mo ago
CVE-2018-25437	high	8.7/10	WordPress CherryFramework Themes 3.1.4 Backup File Download	Jun 15, 2026 1mo ago
CVE-2018-25436	critical	9.3/10	WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload	Jun 15, 2026 1mo ago
CVE-2016-20084	medium	5.1/10	WordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSS	Jun 15, 2026 1mo ago
CVE-2016-20083	medium	6.9/10	WordPress More Fields Plugin 2.1 Cross-Site Request Forgery	Jun 15, 2026 1mo ago
CVE-2016-20082	medium	6.9/10	WordPress Plugin Abtest Local File Inclusion via abtest_admin.php	Jun 15, 2026 1mo ago
CVE-2016-20081	high	8.7/10	WordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File Download	Jun 15, 2026 1mo ago
CVE-2016-20080	medium	6.9/10	WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php	Jun 15, 2026 1mo ago
CVE-2016-20079	medium	6.9/10	WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php	Jun 15, 2026 1mo ago
CVE-2016-20078	medium	6.9/10	WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php	Jun 15, 2026 1mo ago
CVE-2016-20077	medium	6.9/10	WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php	Jun 15, 2026 1mo ago
CVE-2016-20076	high	8.7/10	WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download	Jun 15, 2026 1mo ago
CVE-2016-20075	high	8.7/10	WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE	Jun 15, 2026 1mo ago
CVE-2016-20074	medium	5.3/10	WordPress Lazy Content Slider Plugin 3.4 CSRF	Jun 15, 2026 1mo ago
CVE-2016-20073	high	8.8/10	Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php	Jun 15, 2026 1mo ago
CVE-2016-20072	high	8.8/10	BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid	Jun 15, 2026 1mo ago
CVE-2016-20071	high	8.8/10	WordPress 404 Redirection Manager Plugin 1.0 SQL Injection	Jun 15, 2026 1mo ago
CVE-2016-20070	medium	5.1/10	WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS	Jun 15, 2026 1mo ago
CVE-2016-20069	high	8.8/10	WordPress Booking Calendar Contact Form 1.0.23 SQL Injection	Jun 15, 2026 1mo ago
CVE-2016-20067	medium	5.3/10	WordPress CP Polls 1.0.8 Cross-Site Request Forgery	Jun 15, 2026 1mo ago
CVE-2016-20066	medium	5.1/10	WordPress CP Polls 1.0.8 Persistent Cross-Site Scripting	Jun 15, 2026 1mo ago
CVE-2026-9848	high	7.5/10	WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter	Jun 13, 2026 1mo ago
CVE-2026-24618	medium	4.3/10	WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability	Jun 12, 2026 1mo ago
CVE-2026-9125	medium	6.4/10	The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute	Jun 12, 2026 1mo ago
CVE-2026-42653	high	7.1/10	WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability	Jun 11, 2026 1mo ago