Feed live

WordPress vulnerabilities - every known CVE affecting WordPress core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every CVE that affects WordPress core, plugins, themes, and page builders. Scored and updated from the official NVD feed.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

704

Newly disclosed

Feed last synced

12 hrs ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-23970	high	7.1/10	WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2025-69332	medium	6.5/10	WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2025-68872	high	7.1/10	WordPress Eli's WordCents adSense Widget with Analytics plugin <= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2025-68851	high	7.1/10	WordPress Okay Toolkit plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2025-68840	high	7.1/10	WordPress iRobots.txt SEO plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2025-68049	medium	6.3/10	WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2025-60175	medium	4.4/10	WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability	Jun 15, 2026 12d ago
CVE-2025-59133	high	7.5/10	WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability	Jun 15, 2026 12d ago
CVE-2025-15659	medium	6.5/10	WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2025-15658	medium	5.9/10	WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 12d ago
CVE-2025-64215	medium	6.5/10	WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2026-49064	high	7.5/10	WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability	Jun 15, 2026 12d ago
CVE-2026-48969	medium	6.5/10	WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability	Jun 15, 2026 12d ago
CVE-2026-49111	high	8.8/10	WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability	Jun 15, 2026 12d ago
CVE-2026-49062	high	8.8/10	WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability	Jun 15, 2026 12d ago
CVE-2026-52704	critical	10.0/10	WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability	Jun 15, 2026 12d ago
CVE-2016-20068	high	8.8/10	WordPress Booking Calendar Contact Form 1.0.23 SQL Injection	Jun 15, 2026 12d ago
CVE-2019-25746	high	7.1/10	WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter	Jun 15, 2026 12d ago
CVE-2018-25437	high	8.7/10	WordPress CherryFramework Themes 3.1.4 Backup File Download	Jun 15, 2026 12d ago
CVE-2018-25436	critical	9.3/10	WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload	Jun 15, 2026 12d ago
CVE-2016-20084	medium	5.1/10	WordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSS	Jun 15, 2026 12d ago
CVE-2016-20083	medium	6.9/10	WordPress More Fields Plugin 2.1 Cross-Site Request Forgery	Jun 15, 2026 12d ago
CVE-2016-20082	medium	6.9/10	WordPress Plugin Abtest Local File Inclusion via abtest_admin.php	Jun 15, 2026 12d ago
CVE-2016-20081	high	8.7/10	WordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File Download	Jun 15, 2026 12d ago
CVE-2016-20080	medium	6.9/10	WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php	Jun 15, 2026 12d ago
CVE-2016-20079	medium	6.9/10	WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php	Jun 15, 2026 12d ago
CVE-2016-20078	medium	6.9/10	WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php	Jun 15, 2026 12d ago
CVE-2016-20077	medium	6.9/10	WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php	Jun 15, 2026 12d ago
CVE-2016-20076	high	8.7/10	WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download	Jun 15, 2026 12d ago
CVE-2016-20075	high	8.7/10	WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE	Jun 15, 2026 12d ago