Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

340,026

All time

Critical · Active

10,879

CVSS ≥ 9.0

New · 14 days

2,600

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 631–660 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-14042	medium	6.4/10	Automotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details	May 29, 2026 1mo ago
CVE-2026-8689	medium	4.3/10	Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions	May 28, 2026 1mo ago
CVE-2026-7621	medium	4.3/10	SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate	May 28, 2026 1mo ago
CVE-2022-41656	medium	4.3/10	WordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49054	medium	4.3/10	WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49053	medium	5.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49052	medium	4.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49051	medium	4.3/10	WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49047	medium	4.3/10	WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49046	high	8.5/10	WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability	May 27, 2026 1mo ago
CVE-2026-49044	medium	6.5/10	WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-49045	medium	4.3/10	WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49059	medium	4.7/10	WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability	May 27, 2026 1mo ago
CVE-2026-48973	medium	4.3/10	WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-48972	high	7.5/10	WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability	May 27, 2026 1mo ago
CVE-2026-48971	medium	4.3/10	WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-42762	high	7.1/10	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-42761	critical	9.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability	May 27, 2026 1mo ago
CVE-2026-42760	high	7.5/10	WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability	May 27, 2026 1mo ago
CVE-2026-42759	high	7.1/10	WordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-42758	critical	9.8/10	WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability	May 27, 2026 1mo ago
CVE-2026-42757	critical	9.9/10	WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability	May 27, 2026 1mo ago
CVE-2026-42756	critical	9.9/10	WordPress QuickWebP – Compress / Optimize Images & Convert WebP \| SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerability	May 27, 2026 1mo ago
CVE-2026-42755	critical	9.3/10	WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability	May 27, 2026 1mo ago
CVE-2026-42754	high	7.1/10	WordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-42753	high	7.3/10	WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-42751	medium	6.5/10	WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-42750	medium	6.5/10	WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability	May 27, 2026 1mo ago
CVE-2026-42749	high	7.1/10	WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability	May 27, 2026 1mo ago
CVE-2026-42748	critical	9.9/10	WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability	May 27, 2026 1mo ago