Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-73343	critical	10.0/10	WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability	Aug 18, 2026 12d ago
CVE-2026-73341	critical	9.8/10	WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-73190	high	7.1/10	WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-73187	critical	9.3/10	WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-68567	high	7.1/10	WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-66679	medium	6.5/10	WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-66646	medium	6.5/10	WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-66644	medium	6.5/10	WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-66640	medium	6.5/10	WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-66638	medium	6.5/10	WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-66635	high	7.4/10	WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability	Aug 18, 2026 12d ago
CVE-2026-66633	high	7.1/10	WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-66622	high	7.5/10	WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-66621	high	7.1/10	WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-66620	high	7.2/10	WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-32547	high	7.1/10	WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-32474	critical	9.9/10	WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability	Aug 18, 2026 12d ago
CVE-2026-32470	critical	9.8/10	WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-32468	high	7.5/10	WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability	Aug 18, 2026 12d ago
CVE-2026-32467	medium	6.0/10	WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability	Aug 18, 2026 12d ago
CVE-2026-32466	high	8.5/10	WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-32465	high	8.8/10	WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability	Aug 18, 2026 12d ago
CVE-2026-32464	high	8.1/10	WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability	Aug 18, 2026 12d ago
CVE-2026-32463	critical	9.9/10	WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability	Aug 18, 2026 12d ago
CVE-2026-32444	critical	9.9/10	WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability	Aug 18, 2026 12d ago
CVE-2026-32333	high	7.1/10	WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-28571	high	7.5/10	WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-28570	high	8.1/10	WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability	Aug 18, 2026 12d ago
CVE-2026-28569	high	7.1/10	WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago
CVE-2026-28568	high	7.1/10	WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 12d ago