Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

704

Newly disclosed

Feed last synced

11 hrs ago

Data freshness

Showing 181–210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-39478	high	8.8/10	WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-39474	high	8.8/10	WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-39472	high	7.2/10	WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-39471	high	7.2/10	WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-39470	high	7.2/10	WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability	Jun 15, 2026 12d ago
CVE-2026-39468	medium	6.8/10	WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability	Jun 15, 2026 12d ago
CVE-2026-39465	critical	9.1/10	WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability	Jun 15, 2026 12d ago
CVE-2026-39463	high	7.1/10	WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2026-39451	medium	6.3/10	WordPress WP Google Review Slider plugin <= 18.0 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2026-39450	high	7.1/10	WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability	Jun 15, 2026 12d ago
CVE-2026-39449	high	7.1/10	WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2026-39447	high	7.1/10	WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2026-39441	critical	9.3/10	WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-39435	high	7.1/10	WordPress CformsII plugin <= 15.1.3 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2026-39434	high	7.2/10	WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-34902	high	7.1/10	WordPress WooCommerce Product Table Lite plugin <= 4.6.3 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2026-34901	critical	9.8/10	WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability	Jun 15, 2026 12d ago
CVE-2026-34900	high	7.1/10	WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2026-34898	high	7.5/10	WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2026-34892	medium	6.5/10	WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2026-34891	high	7.5/10	WordPress IDPay Payment Gateway for Woocommerce plugin <= 2.2.5 - Sensitive Data Exposure vulnerability	Jun 15, 2026 12d ago
CVE-2026-34886	high	7.5/10	WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2026-27407	high	7.2/10	WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability	Jun 15, 2026 12d ago
CVE-2026-27333	high	8.1/10	WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability	Jun 15, 2026 12d ago
CVE-2026-27089	high	7.5/10	WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability	Jun 15, 2026 12d ago
CVE-2026-27053	critical	9.8/10	WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-25440	medium	5.3/10	WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2026-25425	high	7.5/10	WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2026-24637	high	8.5/10	WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability	Jun 15, 2026 12d ago
CVE-2026-9691	critical	9.8/10	WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability	Jun 15, 2026 12d ago