Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,463

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,093

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 571–600 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-57743	high	8.1/10	WordPress RT-Theme 18 \| Extensions plugin <= 2.5 - Local File Inclusion vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57741	high	7.1/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57740	high	7.1/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57739	critical	9.3/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57738	critical	9.8/10	WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57734	high	7.1/10	WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57733	high	7.1/10	WordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57732	high	7.1/10	WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57729	high	7.5/10	WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57728	high	7.1/10	WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57727	high	7.5/10	WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57726	critical	9.3/10	WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57725	high	7.1/10	WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57724	critical	9.8/10	WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57719	critical	10.0/10	WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57718	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57715	high	7.1/10	WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57714	critical	9.3/10	WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57713	high	8.8/10	WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57712	high	7.1/10	WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57711	medium	6.5/10	WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57710	critical	9.9/10	WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57709	high	8.6/10	WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57708	high	7.1/10	WordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57707	critical	9.3/10	WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57706	high	7.1/10	WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57705	high	7.5/10	WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57702	critical	9.3/10	WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57698	medium	6.5/10	WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57697	high	7.5/10	WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability	Jul 13, 2026 1mo ago