Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

352,137

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,111

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-82220	medium	5.3/10	WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability	Aug 28, 2026 22d ago
CVE-2026-81767	high	7.5/10	WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability	Aug 28, 2026 22d ago
CVE-2026-81761	medium	4.3/10	WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability	Aug 28, 2026 22d ago
CVE-2026-81760	high	7.1/10	WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2026 22d ago
CVE-2026-81759	medium	5.4/10	WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability	Aug 28, 2026 22d ago
CVE-2026-81757	high	7.2/10	WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability	Aug 28, 2026 22d ago
CVE-2026-81299	medium	4.3/10	WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability	Aug 28, 2026 22d ago
CVE-2026-81285	high	7.5/10	WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability	Aug 28, 2026 22d ago
CVE-2026-82227	high	8.5/10	WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability	Aug 28, 2026 22d ago
CVE-2026-81284	medium	4.3/10	WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability	Aug 28, 2026 22d ago
CVE-2026-82222	critical	10.0/10	WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability	Aug 28, 2026 22d ago
CVE-2026-81777	medium	5.3/10	WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability	Aug 28, 2026 23d ago
CVE-2026-82123	medium	6.5/10	WordPress Loops & Logic - Reflected XSS	Aug 28, 2026 23d ago
CVE-2026-81277	high	8.5/10	WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability	Aug 27, 2026 24d ago
CVE-2026-81276	medium	5.3/10	WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability	Aug 27, 2026 24d ago
CVE-2026-81274	medium	5.3/10	WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability	Aug 27, 2026 24d ago
CVE-2026-81273	high	8.1/10	WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability	Aug 27, 2026 24d ago
CVE-2026-81272	medium	4.9/10	WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability	Aug 27, 2026 24d ago
CVE-2026-81271	high	8.8/10	WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability	Aug 27, 2026 24d ago
CVE-2026-80433	high	7.5/10	WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability	Aug 27, 2026 24d ago
CVE-2026-78293	high	7.1/10	WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 24d ago
CVE-2026-78292	critical	9.8/10	WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability	Aug 27, 2026 24d ago
CVE-2026-78289	high	7.1/10	WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 24d ago
CVE-2026-78288	critical	9.3/10	WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability	Aug 27, 2026 24d ago
CVE-2026-78286	critical	9.8/10	WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability	Aug 27, 2026 24d ago
CVE-2026-78285	high	8.5/10	WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability	Aug 27, 2026 24d ago
CVE-2026-78283	high	7.1/10	WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 24d ago
CVE-2026-78281	high	7.1/10	WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 24d ago
CVE-2026-78276	high	7.2/10	WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability	Aug 27, 2026 24d ago
CVE-2026-78275	medium	6.8/10	WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability	Aug 27, 2026 24d ago