Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

706

Newly disclosed

Feed last synced

7 hrs ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42687	high	8.1/10	WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-42686	high	7.1/10	WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-42668	high	7.5/10	WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability	Jun 15, 2026 11d ago
CVE-2026-42667	high	7.5/10	WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago
CVE-2026-42666	high	7.5/10	WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-42665	critical	9.3/10	WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-42664	high	8.2/10	WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-42663	medium	6.5/10	WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-42662	medium	6.5/10	WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability	Jun 15, 2026 11d ago
CVE-2026-42661	high	8.8/10	WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability	Jun 15, 2026 11d ago
CVE-2026-42660	medium	6.5/10	WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago
CVE-2026-42659	medium	6.5/10	WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-42658	high	7.1/10	WordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-42657	medium	6.5/10	WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability	Jun 15, 2026 11d ago
CVE-2026-42656	medium	6.5/10	WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-42655	high	7.5/10	WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability	Jun 15, 2026 11d ago
CVE-2026-42651	medium	6.3/10	WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-42650	high	7.2/10	WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-42649	high	7.1/10	WordPress Favicon Rotator plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-42640	medium	6.5/10	WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-42639	critical	9.3/10	WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-42411	high	8.1/10	WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability	Jun 15, 2026 11d ago
CVE-2026-42386	critical	9.3/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-42384	high	7.5/10	WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago
CVE-2026-42381	critical	9.3/10	WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-42378	medium	6.5/10	WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability	Jun 15, 2026 11d ago
CVE-2026-41556	medium	6.5/10	WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-40799	medium	5.8/10	WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability	Jun 15, 2026 11d ago
CVE-2026-40798	critical	9.3/10	WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-40796	medium	6.5/10	WordPress WPPizza plugin <= 3.19.9 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago