Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,811

All time

Critical · Active

12,639

CVSS ≥ 9.0

New · 14 days

1,500

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-94160	high	7.1/10	WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability	Oct 10, 2026 3d ago
CVE-2026-62044	high	7.2/10	WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability	Oct 10, 2026 3d ago
CVE-2026-97340	medium	6.4/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field	Oct 10, 2026 3d ago
CVE-2026-104759	high	8.1/10	WPO365 \| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 \| LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification	Oct 10, 2026 3d ago
CVE-2026-97396	medium	6.4/10	Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint	Oct 10, 2026 3d ago
CVE-2026-96765	high	7.2/10	WPO365 \| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 \| LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)	Oct 10, 2026 3d ago
CVE-2026-94062	high	8.1/10	WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability	Oct 9, 2026 4d ago
CVE-2026-62036	medium	4.3/10	WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability	Oct 9, 2026 4d ago
CVE-2026-95598	high	7.1/10	WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability	Oct 9, 2026 4d ago
CVE-2026-95610	high	8.5/10	WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability	Oct 9, 2026 4d ago
CVE-2026-96337	medium	6.5/10	WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability	Oct 9, 2026 4d ago
CVE-2026-27420	medium	6.5/10	WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability	Oct 8, 2026 5d ago
CVE-2026-106611	high	7.1/10	WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability	Oct 8, 2026 5d ago
CVE-2026-103072	medium	4.3/10	WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability	Oct 8, 2026 5d ago
CVE-2026-105888	medium	5.4/10	WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability	Oct 8, 2026 5d ago
CVE-2026-106603	medium	6.5/10	WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability	Oct 8, 2026 5d ago
CVE-2026-82627	high	7.5/10	Uncanny Automator – AI + Automation for WordPress \| AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion	Oct 8, 2026 5d ago
CVE-2026-17538	medium	5.4/10	Appointment Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification	Oct 7, 2026 6d ago
CVE-2026-95606	critical	9.8/10	WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability	Oct 7, 2026 6d ago
CVE-2026-94662	high	7.1/10	WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability	Oct 7, 2026 6d ago
CVE-2026-42714	high	7.6/10	WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability	Oct 7, 2026 6d ago
CVE-2026-66666	medium	6.9/10	WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability	Oct 6, 2026 7d ago
CVE-2026-42638	high	7.5/10	WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability	Oct 6, 2026 7d ago
CVE-2026-42418	high	7.1/10	WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability	Oct 6, 2026 7d ago
CVE-2026-42700	medium	6.5/10	WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability	Oct 5, 2026 8d ago
CVE-2026-105421	medium	5.3/10	WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability	Oct 5, 2026 8d ago
CVE-2026-104402	medium	4.3/10	WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability	Oct 4, 2026 9d ago
CVE-2026-97307	high	7.5/10	WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability	Oct 4, 2026 9d ago
CVE-2026-103355	critical	9.3/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability	Oct 4, 2026 9d ago
CVE-2026-103344	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability	Oct 4, 2026 9d ago