Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,811

All time

Critical · Active

12,639

CVSS ≥ 9.0

New · 14 days

1,500

Newly disclosed

Feed last synced

25 mins ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-62077	critical	9.8/10	WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-62076	critical	9.8/10	WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-62075	high	8.1/10	WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62074	high	8.1/10	WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62070	high	8.1/10	WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62069	high	8.1/10	WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62068	high	8.1/10	WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62067	high	8.1/10	WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62066	high	8.1/10	WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62065	high	8.1/10	WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-62054	critical	9.8/10	WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-62053	critical	9.8/10	WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-62052	critical	9.8/10	WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-62051	critical	9.8/10	WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-62050	critical	9.8/10	WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-62020	high	8.1/10	WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-48194	high	8.1/10	WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-48193	high	8.1/10	WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-42777	high	8.1/10	WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-42724	high	8.1/10	WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-42723	critical	9.8/10	WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-42718	critical	9.8/10	WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-42716	critical	9.8/10	WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-42704	high	8.1/10	WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability	Oct 10, 2026 3d ago
CVE-2026-106609	high	7.5/10	WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability	Oct 10, 2026 3d ago
CVE-2026-106608	high	7.2/10	WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability	Oct 10, 2026 3d ago
CVE-2026-105889	critical	9.3/10	WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-104398	critical	9.8/10	WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-103357	medium	6.9/10	WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability	Oct 10, 2026 3d ago
CVE-2026-103071	high	7.5/10	WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability	Oct 10, 2026 3d ago