Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

339,687

All time

Critical · Active

10,849

CVSS ≥ 9.0

New · 14 days

2,595

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-57695	high	7.1/10	WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57694	medium	6.5/10	WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57693	medium	6.5/10	WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57691	medium	5.8/10	WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57668	high	7.1/10	WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57424	medium	6.5/10	WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57423	high	7.1/10	WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57422	high	7.1/10	WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57421	high	7.1/10	WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57420	medium	6.5/10	WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57419	medium	6.5/10	WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57418	medium	6.5/10	WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57417	high	7.1/10	WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57416	high	7.1/10	WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57415	high	7.1/10	WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57414	medium	6.5/10	WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57413	medium	6.4/10	WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57412	medium	6.5/10	WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57411	high	7.1/10	WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57410	high	8.8/10	WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability	Jul 13, 2026 4d ago
CVE-2026-57409	high	7.1/10	WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57408	medium	6.5/10	WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57407	high	7.2/10	WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57406	medium	6.5/10	WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57405	high	7.1/10	WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57404	medium	6.5/10	WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57403	high	7.1/10	WordPress GD Security Headers plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57402	medium	6.5/10	WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57401	critical	9.9/10	WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability	Jul 13, 2026 4d ago
CVE-2026-57400	medium	6.5/10	WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability	Jul 13, 2026 4d ago