Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

344,212

All time

Critical · Active

11,538

CVSS ≥ 9.0

New · 14 days

2,638

Newly disclosed

Feed last synced

58 mins ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-65513	high	7.1/10	WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65509	high	7.1/10	WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65508	critical	9.3/10	WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65507	critical	9.8/10	WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability	Aug 6, 2026 yesterday
CVE-2026-65504	high	7.5/10	WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2026-65502	medium	5.3/10	WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability	Aug 6, 2026 yesterday
CVE-2026-61982	high	7.1/10	WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-61964	high	7.1/10	WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-61963	high	7.1/10	WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-61961	high	7.1/10	WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-61959	medium	6.5/10	WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-32548	medium	5.3/10	WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2026-32469	medium	5.3/10	WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability	Aug 6, 2026 yesterday
CVE-2026-28180	medium	5.3/10	WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability	Aug 6, 2026 yesterday
CVE-2026-28179	medium	5.9/10	WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-28178	medium	6.5/10	WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-28177	high	7.1/10	WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-28172	high	7.1/10	WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability	Aug 6, 2026 yesterday
CVE-2026-28169	medium	5.3/10	WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability	Aug 6, 2026 yesterday
CVE-2026-28146	medium	6.5/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability	Aug 6, 2026 yesterday
CVE-2026-28143	high	7.1/10	WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-28141	high	7.1/10	WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-28140	high	7.5/10	WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2026-28139	critical	9.8/10	WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-28111	high	8.8/10	WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability	Aug 6, 2026 yesterday
CVE-2026-28082	high	7.1/10	WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-28005	critical	9.8/10	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability	Aug 6, 2026 yesterday
CVE-2026-25403	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2026-66712	high	7.5/10	WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2025-15028	high	7.2/10	FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting	Aug 6, 2026 yesterday