Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

5 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-49775	medium	6.5/10	WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-49773	medium	6.5/10	WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-49770	critical	9.8/10	WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49769	critical	9.8/10	WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49768	critical	9.8/10	WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49766	critical	9.9/10	WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability	Jun 15, 2026 11d ago
CVE-2026-49765	critical	9.8/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49764	critical	9.8/10	WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability	Jun 15, 2026 11d ago
CVE-2026-49763	critical	9.8/10	WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49112	high	7.5/10	WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability	Jun 15, 2026 11d ago
CVE-2026-49110	high	7.5/10	WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability	Jun 15, 2026 11d ago
CVE-2026-49109	critical	9.8/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49106	critical	9.8/10	WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49105	critical	9.8/10	WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49104	critical	9.8/10	WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49085	critical	9.8/10	WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49083	high	7.5/10	WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability	Jun 15, 2026 11d ago
CVE-2026-49082	high	7.4/10	WordPress Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin <= 1.4.8 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago
CVE-2026-49078	high	7.5/10	WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability	Jun 15, 2026 11d ago
CVE-2026-49070	high	7.5/10	WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-49068	high	7.5/10	WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago
CVE-2026-49067	critical	9.3/10	WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-49066	high	7.5/10	WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago
CVE-2026-49065	high	8.2/10	WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-49063	high	7.3/10	WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability	Jun 15, 2026 11d ago
CVE-2026-49061	high	7.5/10	WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability	Jun 15, 2026 11d ago
CVE-2026-49056	high	7.5/10	WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago
CVE-2026-49055	high	7.1/10	WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-49043	medium	4.7/10	WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability	Jun 15, 2026 11d ago
CVE-2026-48970	high	8.1/10	WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability	Jun 15, 2026 11d ago