Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,811

All time

Critical · Active

12,639

CVSS ≥ 9.0

New · 14 days

1,496

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-97276	high	7.1/10	WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability	Oct 4, 2026 9d ago
CVE-2026-103062	high	7.1/10	WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability	Oct 4, 2026 9d ago
CVE-2026-103354	high	7.1/10	WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability	Oct 4, 2026 9d ago
CVE-2026-96451	high	8.8/10	WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability	Oct 3, 2026 10d ago
CVE-2026-103342	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability	Oct 3, 2026 10d ago
CVE-2026-103065	high	8.2/10	WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability	Oct 3, 2026 10d ago
CVE-2026-39601	low	3.7/10	WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability	Oct 2, 2026 11d ago
CVE-2026-32585	medium	6.5/10	WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability	Oct 2, 2026 11d ago
CVE-2026-104403	medium	5.3/10	WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability	Oct 2, 2026 11d ago
CVE-2026-94180	medium	4.3/10	WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability	Oct 2, 2026 11d ago
CVE-2026-84925	medium	6.1/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter	Oct 2, 2026 11d ago
CVE-2026-97273	high	7.1/10	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2026 12d ago
CVE-2026-97258	medium	6.5/10	WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability	Oct 1, 2026 12d ago
CVE-2026-62073	high	7.5/10	WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability	Oct 1, 2026 12d ago
CVE-2026-62059	high	7.6/10	WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability	Oct 1, 2026 12d ago
CVE-2026-103064	medium	6.5/10	WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2026 12d ago
CVE-2026-102382	medium	4.3/10	WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability	Oct 1, 2026 12d ago
CVE-2026-103341	medium	5.3/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability	Oct 1, 2026 12d ago
CVE-2026-103336	medium	5.3/10	WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability	Oct 1, 2026 12d ago
CVE-2026-94171	high	7.1/10	WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability	Sep 30, 2026 13d ago
CVE-2026-97287	high	8.5/10	WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability	Sep 30, 2026 13d ago
CVE-2026-96326	high	7.2/10	HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field	Sep 29, 2026 15d ago
CVE-2026-96752	high	7.2/10	Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration	Sep 25, 2026 18d ago
CVE-2026-87917	medium	6.1/10	MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag	Sep 19, 2026 24d ago
CVE-2026-16482	high	7.5/10	rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter	Sep 12, 2026 1mo ago
CVE-2026-77705	—	—	Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover	Sep 12, 2026 1mo ago
CVE-2026-81789	high	8.6/10	WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability	Sep 10, 2026 1mo ago
CVE-2026-81792	medium	6.5/10	WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability	Sep 8, 2026 1mo ago
CVE-2026-85305	medium	5.4/10	WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84847	high	7.5/10	WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability	Sep 3, 2026 1mo ago