Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

354,834

All time

Critical · Active

12,642

CVSS ≥ 9.0

New · 14 days

1,510

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 241–270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66646	medium	6.5/10	WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66644	medium	6.5/10	WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66640	medium	6.5/10	WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66638	medium	6.5/10	WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66635	high	7.4/10	WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66633	high	7.1/10	WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66627	critical	9.9/10	WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66622	high	7.5/10	WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66621	high	7.1/10	WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-66620	high	7.2/10	WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32547	high	7.1/10	WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32474	critical	9.9/10	WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32470	critical	9.8/10	WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32468	high	7.5/10	WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32467	medium	6.0/10	WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32466	high	8.5/10	WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32465	high	8.8/10	WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32464	high	8.1/10	WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32463	critical	9.9/10	WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32444	critical	9.9/10	WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-32333	high	7.1/10	WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28571	high	7.5/10	WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28570	high	8.1/10	WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28569	high	7.1/10	WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28568	high	7.1/10	WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28567	high	7.5/10	WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28192	critical	9.6/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28191	high	8.8/10	WordPress The Grid plugin <= 2.7.9.1 - Privilege Escalation vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28002	high	8.5/10	WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability	Aug 13, 2026 2mo ago
CVE-2026-73403	medium	5.3/10	WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability	Aug 13, 2026 2mo ago