Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

352,139

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,107

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66426	high	7.1/10	WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66424	critical	9.8/10	WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability	Aug 13, 2026 1mo ago
CVE-2026-65582	high	7.7/10	WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability	Aug 13, 2026 1mo ago
CVE-2026-65580	high	7.1/10	WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61984	high	7.5/10	WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61980	high	7.5/10	WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61979	high	8.1/10	WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61978	medium	6.5/10	WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61974	high	7.1/10	WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61969	critical	9.3/10	WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61967	critical	9.8/10	WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61966	critical	9.3/10	WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61965	high	7.1/10	WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61962	critical	10.0/10	WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability	Aug 13, 2026 1mo ago
CVE-2026-61960	high	7.1/10	WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28189	high	7.4/10	WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28188	high	7.3/10	WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28187	high	7.1/10	WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28186	high	8.1/10	WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28185	critical	9.8/10	WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28184	high	8.5/10	WordPress Form Maker by 10Web plugin <= 1.15.44 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28182	medium	6.5/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28181	medium	6.5/10	WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28176	high	8.8/10	WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28175	high	7.1/10	WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28174	medium	6.5/10	WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28173	high	7.1/10	WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28170	high	7.1/10	WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28168	high	8.5/10	WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-28161	high	8.8/10	WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability	Aug 13, 2026 1mo ago