Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

344,202

All time

Critical · Active

11,536

CVSS ≥ 9.0

New · 14 days

2,631

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-65578	critical	9.8/10	WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65577	critical	9.8/10	WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65576	critical	9.8/10	WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65575	critical	9.8/10	WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65574	critical	9.8/10	WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65573	critical	9.8/10	WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65572	critical	9.8/10	WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65571	critical	9.8/10	WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65570	high	8.1/10	WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability	Aug 6, 2026 yesterday
CVE-2026-65569	high	8.5/10	WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65565	high	7.1/10	WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65560	high	7.1/10	WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65559	high	7.2/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability	Aug 6, 2026 yesterday
CVE-2026-65556	critical	9.8/10	WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65554	high	7.1/10	WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2026-65553	critical	10.0/10	WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65552	critical	9.8/10	WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65549	high	7.2/10	WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65548	critical	9.9/10	WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65547	high	8.5/10	WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65546	critical	9.3/10	WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65545	high	7.1/10	WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65544	high	7.1/10	WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65543	high	7.5/10	WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability	Aug 6, 2026 yesterday
CVE-2026-65542	high	8.8/10	WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability	Aug 6, 2026 yesterday
CVE-2026-65541	high	7.3/10	WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2026-65523	high	7.5/10	WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65520	critical	9.3/10	WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65517	high	7.1/10	WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65515	high	7.1/10	WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday