Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

336,925

All time

Critical · Active

10,649

CVSS ≥ 9.0

New · 14 days

1,571

Newly disclosed

Feed last synced

42 mins ago

Data freshness

Showing 1831–1860 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25404	medium	5.3/10	WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25402	medium	4.3/10	WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25399	medium	4.3/10	WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25395	medium	4.3/10	WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25394	medium	4.3/10	WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25393	medium	4.3/10	WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25392	medium	4.7/10	WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25391	medium	5.4/10	WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25389	medium	5.3/10	WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25388	medium	5.4/10	WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25387	medium	4.3/10	WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25386	medium	5.3/10	WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25385	medium	5.5/10	WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25384	medium	5.3/10	WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25378	high	7.6/10	WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25375	medium	4.3/10	WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25374	medium	5.3/10	WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25372	medium	6.5/10	WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25370	medium	5.3/10	WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25368	medium	6.5/10	WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25367	medium	5.3/10	WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25364	medium	5.3/10	WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25363	medium	4.3/10	WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25362	medium	5.9/10	WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25348	medium	5.3/10	WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25343	medium	5.9/10	WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25338	medium	5.3/10	WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25337	medium	5.4/10	WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25336	medium	5.3/10	WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25335	medium	4.3/10	WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago