Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

705

Newly disclosed

Feed last synced

10 hrs ago

Data freshness

Showing 151–180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-39587	high	8.1/10	WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability	Jun 15, 2026 11d ago
CVE-2026-39584	medium	6.5/10	WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-39583	critical	9.8/10	WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability	Jun 15, 2026 11d ago
CVE-2026-39579	high	8.8/10	WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability	Jun 15, 2026 11d ago
CVE-2026-39540	medium	6.5/10	WordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-39534	high	7.5/10	WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-39533	high	7.5/10	WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-39532	high	8.8/10	WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39530	critical	9.3/10	WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39527	medium	5.4/10	WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability	Jun 15, 2026 11d ago
CVE-2026-39525	medium	6.5/10	WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-39524	high	7.5/10	WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability	Jun 15, 2026 11d ago
CVE-2026-39519	critical	9.3/10	WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39518	high	7.1/10	WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability	Jun 15, 2026 11d ago
CVE-2026-39515	medium	6.5/10	WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-39514	high	7.1/10	WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-39513	high	7.5/10	WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-39512	critical	9.3/10	WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39511	critical	9.3/10	WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39507	high	7.1/10	WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-39503	high	7.5/10	WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability	Jun 15, 2026 11d ago
CVE-2026-39502	critical	9.3/10	WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39499	high	7.2/10	WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39498	high	7.2/10	WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39493	critical	9.3/10	WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39492	critical	9.3/10	WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39491	medium	6.5/10	WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 11d ago
CVE-2026-39489	medium	4.4/10	WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability	Jun 15, 2026 11d ago
CVE-2026-39481	high	7.2/10	WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability	Jun 15, 2026 11d ago
CVE-2026-39480	high	7.5/10	WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability	Jun 15, 2026 11d ago