Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-78274	critical	9.1/10	WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability	Aug 27, 2026 3d ago
CVE-2026-78273	medium	6.5/10	WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 3d ago
CVE-2026-78271	high	7.2/10	WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability	Aug 27, 2026 3d ago
CVE-2026-78261	high	7.1/10	WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 3d ago
CVE-2026-78260	critical	9.3/10	WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability	Aug 27, 2026 3d ago
CVE-2026-78257	high	8.8/10	WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability	Aug 27, 2026 3d ago
CVE-2026-32566	critical	9.8/10	WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability	Aug 27, 2026 3d ago
CVE-2026-32564	high	8.5/10	WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability	Aug 27, 2026 3d ago
CVE-2026-32550	high	8.5/10	WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability	Aug 27, 2026 3d ago
CVE-2026-32479	critical	9.3/10	WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability	Aug 27, 2026 3d ago
CVE-2026-27330	high	8.6/10	WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability	Aug 27, 2026 3d ago
CVE-2026-81279	medium	5.4/10	WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability	Aug 27, 2026 3d ago
CVE-2026-78267	critical	9.8/10	WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability	Aug 24, 2026 6d ago
CVE-2026-78262	critical	9.8/10	WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability	Aug 24, 2026 6d ago
CVE-2026-32559	critical	9.9/10	WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability	Aug 24, 2026 6d ago
CVE-2026-66670	high	8.1/10	WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability	Aug 24, 2026 6d ago
CVE-2026-66650	critical	9.8/10	WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability	Aug 24, 2026 6d ago
CVE-2026-66648	critical	9.8/10	WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability	Aug 24, 2026 6d ago
CVE-2026-66610	high	7.1/10	WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability	Aug 24, 2026 6d ago
CVE-2026-66587	critical	9.8/10	WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability	Aug 24, 2026 6d ago
CVE-2026-66585	high	7.5/10	WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability	Aug 24, 2026 6d ago
CVE-2026-32558	critical	9.8/10	WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability	Aug 24, 2026 6d ago
CVE-2026-32551	critical	9.3/10	WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability	Aug 24, 2026 6d ago
CVE-2026-32478	high	8.5/10	WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability	Aug 24, 2026 6d ago
CVE-2026-32477	high	8.6/10	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability	Aug 24, 2026 6d ago
CVE-2026-32476	high	7.1/10	WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability	Aug 24, 2026 6d ago
CVE-2026-32471	high	8.5/10	WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability	Aug 24, 2026 6d ago
CVE-2026-28190	high	7.1/10	WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability	Aug 24, 2026 6d ago
CVE-2026-28171	high	8.6/10	WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability	Aug 24, 2026 6d ago
CVE-2026-28167	high	7.5/10	WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability	Aug 24, 2026 6d ago