Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,811

All time

Critical · Active

12,639

CVSS ≥ 9.0

New · 14 days

1,496

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 121–150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-84812	high	7.1/10	WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84774	medium	6.1/10	WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84766	medium	5.9/10	WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84758	medium	6.5/10	WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84753	critical	9.8/10	WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84215	medium	6.5/10	WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability	Sep 3, 2026 1mo ago
CVE-2026-81773	high	7.1/10	WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability	Sep 3, 2026 1mo ago
CVE-2026-81292	high	7.1/10	WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84849	medium	6.5/10	WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84815	medium	5.8/10	WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability	Sep 3, 2026 1mo ago
CVE-2026-84217	medium	5.4/10	WordPress Classified Listing plugin <= 6.1.1 - Broken Access Control vulnerability	Sep 2, 2026 1mo ago
CVE-2026-84835	medium	5.3/10	WordPress Rentsyst plugin <= 2.1.2 - Broken Access Control vulnerability	Sep 2, 2026 1mo ago
CVE-2026-66652	medium	5.4/10	WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability	Sep 2, 2026 1mo ago
CVE-2026-81772	high	8.8/10	WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability	Sep 2, 2026 1mo ago
CVE-2026-84781	medium	6.5/10	WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability	Sep 2, 2026 1mo ago
CVE-2026-82883	high	7.1/10	WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability	Sep 2, 2026 1mo ago
CVE-2026-18550	critical	9.8/10	Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter	Sep 1, 2026 1mo ago
CVE-2026-82226	critical	9.8/10	WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability	Aug 31, 2026 1mo ago
CVE-2026-81778	medium	6.5/10	WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Aug 31, 2026 1mo ago
CVE-2026-81762	medium	6.5/10	WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability	Aug 31, 2026 1mo ago
CVE-2026-81296	high	7.5/10	WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability	Aug 31, 2026 1mo ago
CVE-2026-81280	medium	6.5/10	WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability	Aug 31, 2026 1mo ago
CVE-2026-83492	medium	6.9/10	WordPress Kubio AI Website Builder - Denial Of Service	Aug 31, 2026 1mo ago
CVE-2026-74010	medium	5.3/10	WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability	Aug 31, 2026 1mo ago
CVE-2026-82220	medium	5.3/10	WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability	Aug 28, 2026 1mo ago
CVE-2026-81767	high	7.5/10	WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability	Aug 28, 2026 1mo ago
CVE-2026-81761	medium	4.3/10	WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability	Aug 28, 2026 1mo ago
CVE-2026-81760	high	7.1/10	WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2026 1mo ago
CVE-2026-81759	medium	5.4/10	WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability	Aug 28, 2026 1mo ago
CVE-2026-81757	high	7.2/10	WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability	Aug 28, 2026 1mo ago