Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

339,703

All time

Critical · Active

10,851

CVSS ≥ 9.0

New · 14 days

2,582

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-57359	high	7.1/10	WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57358	high	7.1/10	WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57357	high	7.1/10	WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57356	high	7.1/10	WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57355	medium	6.5/10	WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability	Jul 2, 2026 15d ago
CVE-2026-57354	medium	6.5/10	WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57353	medium	6.5/10	WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability	Jul 2, 2026 15d ago
CVE-2026-57352	medium	4.8/10	WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability	Jul 2, 2026 15d ago
CVE-2026-57351	high	7.1/10	WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57350	high	7.1/10	WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57349	high	7.1/10	WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57348	high	7.2/10	WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57347	medium	6.5/10	WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability	Jul 2, 2026 15d ago
CVE-2026-57345	high	7.1/10	WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57344	high	7.1/10	WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57343	high	7.1/10	WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-57342	medium	6.5/10	WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-49779	medium	6.5/10	WordPress Tax Exempt for WooCommerce plugin <= 1.9.3 - Path Traversal vulnerability	Jul 2, 2026 15d ago
CVE-2026-42382	high	8.1/10	WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability	Jul 2, 2026 15d ago
CVE-2026-39448	high	7.5/10	WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability	Jul 2, 2026 15d ago
CVE-2026-27436	critical	9.1/10	WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability	Jul 2, 2026 15d ago
CVE-2026-27433	medium	6.5/10	WordPress Motors theme <= 5.6.80 - Broken Access Control vulnerability	Jul 2, 2026 15d ago
CVE-2026-27430	high	7.1/10	WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-27426	high	7.1/10	WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-27425	high	7.1/10	WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-27419	critical	9.9/10	WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability	Jul 2, 2026 15d ago
CVE-2026-27414	high	8.8/10	WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability	Jul 2, 2026 15d ago
CVE-2026-27412	high	8.1/10	WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability	Jul 2, 2026 15d ago
CVE-2026-27408	high	7.1/10	WordPress NativeChurch theme <= 4.8.8.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago
CVE-2026-27404	high	7.1/10	WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 2, 2026 15d ago