Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-28166	high	7.1/10	WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability	Aug 24, 2026 6d ago
CVE-2026-28165	critical	9.8/10	WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability	Aug 24, 2026 6d ago
CVE-2026-28162	high	7.1/10	WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability	Aug 24, 2026 6d ago
CVE-2026-28153	high	7.5/10	WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability	Aug 24, 2026 6d ago
CVE-2026-28152	high	8.1/10	WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability	Aug 24, 2026 6d ago
CVE-2026-28151	high	8.1/10	WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability	Aug 24, 2026 6d ago
CVE-2026-66671	high	8.1/10	WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability	Aug 24, 2026 6d ago
CVE-2026-66611	high	7.1/10	WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability	Aug 20, 2026 10d ago
CVE-2026-66595	medium	5.9/10	WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability	Aug 20, 2026 10d ago
CVE-2026-66586	medium	6.6/10	WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability	Aug 20, 2026 10d ago
CVE-2025-53999	medium	6.5/10	WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability	Aug 20, 2026 10d ago
CVE-2026-74021	high	7.5/10	WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability	Aug 20, 2026 10d ago
CVE-2026-66602	high	8.8/10	WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability	Aug 18, 2026 12d ago
CVE-2026-74015	critical	9.3/10	WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-74009	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2026 12d ago
CVE-2026-74006	medium	4.3/10	WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-74003	medium	4.3/10	WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-73995	medium	5.4/10	WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability	Aug 18, 2026 12d ago
CVE-2026-73404	medium	6.5/10	WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-73398	medium	6.5/10	WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability	Aug 18, 2026 12d ago
CVE-2026-73396	high	7.1/10	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability	Aug 18, 2026 12d ago
CVE-2026-73392	critical	9.3/10	WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-73382	high	7.1/10	WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-73379	medium	6.5/10	WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability	Aug 18, 2026 12d ago
CVE-2026-73377	high	7.5/10	WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-73365	critical	9.3/10	WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-73360	high	7.1/10	WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-73358	high	7.1/10	WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-73352	medium	6.5/10	WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-73350	high	8.2/10	WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability	Aug 18, 2026 12d ago