Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,834

All time

Critical · Active

12,642

CVSS ≥ 9.0

New · 14 days

1,510

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66671	high	8.1/10	WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability	Aug 24, 2026 1mo ago
CVE-2026-66611	high	7.1/10	WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability	Aug 20, 2026 1mo ago
CVE-2026-66595	medium	5.9/10	WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability	Aug 20, 2026 1mo ago
CVE-2026-66586	medium	6.6/10	WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability	Aug 20, 2026 1mo ago
CVE-2025-53999	medium	6.5/10	WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability	Aug 20, 2026 1mo ago
CVE-2026-74021	high	7.5/10	WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability	Aug 20, 2026 1mo ago
CVE-2026-66602	high	8.8/10	WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-74015	critical	9.3/10	WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-74009	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-74006	medium	4.3/10	WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-74003	medium	4.3/10	WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73995	medium	5.4/10	WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73404	medium	6.5/10	WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73398	medium	6.5/10	WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73396	high	7.1/10	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73392	critical	9.3/10	WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73382	high	7.1/10	WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73379	medium	6.5/10	WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73377	high	7.5/10	WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73365	critical	9.3/10	WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73360	high	7.1/10	WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73358	high	7.1/10	WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73352	medium	6.5/10	WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73350	high	8.2/10	WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73343	critical	10.0/10	WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73341	critical	9.8/10	WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73190	high	7.1/10	WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73187	critical	9.3/10	WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-68567	high	7.1/10	WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66679	medium	6.5/10	WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago