CVE Tools
Track your stack

Web & CMS Plugins

68,828 CVEs tracked since 1999. In the last 12 months, 15,077, +22% on the 12 before.

Web & CMS Plugins by subsector, Oct 2026 so far

Oct 2026 so far: 1,731 CVEs across 7 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • WordPress plugins72642% · 314 vendors
  • CMS cores50129% · 110 vendors
  • Not yet sub-classified188The tagger has not placed these yet
  • WordPress themes1167% · 39 vendors
  • E-commerce platforms966% · 55 vendors
  • Site builders925% · 41 vendors
  • Forums & wikis121% · 9 vendors

Month by month

Every monthly snapshot of Web & CMS Plugins. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Web & CMS Plugins CVEs per month
MonthCVEs
2021-10242
2021-11227
2021-12226
2022-01270
2022-02338
2022-03395
2022-04313
2022-05342
2022-06388
2022-07234
2022-08406
2022-09353
2022-10250
2022-11391
2022-12350
2023-01450
2023-02452
2023-030
2023-04620
2023-05591
2023-06663
2023-07527
2023-08467
2023-09489
2023-10695
2023-11805
2023-12740
2024-01687
2024-02743
2024-031119
2024-041062
2024-051156
2024-06952
2024-07844
2024-08842
2024-09539
2024-10978
2024-11990
2024-121062
2025-011334
2025-02822
2025-031033
2025-041321
2025-051003
2025-061052
2025-07843
2025-08882
2025-091043
2025-10939
2025-11794
2025-121423
2026-011115
2026-021107
2026-031581
2026-041025
2026-051134
2026-061476
2026-071394
2026-081418
2026-091671
2026-101731

Vendors

Who shipped the most Web & CMS Plugins CVEs in Oct 2026 so far, with their rank across all vendors.

  1. Apache Software Foundation315#5
  2. Drupal72#16
  3. Tryghost54#24
  4. Yeswiki45#29
  5. Apache44#30
  6. @backstage41#32
  7. Sourcecodester40#34
  8. Apostrophecms33#46

Weaknesses

The weakness classes behind Web & CMS Plugins CVEs in Oct 2026 so far.

  1. CWE-79 XSS638
  2. CWE-862 Missing Authorization340
  3. CWE-89 SQL Injection144
  4. CWE-639 Auth Bypass via User Key113
  5. CWE-863 Incorrect Authorization90
  6. CWE-22 Path Traversal74

Latest CVEs

The 15 most recently published vulnerabilities in Web & CMS Plugins.

  1. CVE-2026-103039Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field9.8
  2. CVE-2026-97645Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field7.2
  3. CVE-2026-89435Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter8.8
  4. CVE-2026-116622Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie7.2
  5. CVE-2026-90437Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values7.2
  6. CVE-2026-119087Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter4.3
  7. CVE-2026-119059Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action4.3
  8. CVE-2026-118634Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute6.4
  9. CVE-2026-118500Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter6.4
  10. CVE-2026-118698JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute6.5
  11. CVE-2026-5461Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata6.5
  12. CVE-2026-104368Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field8.8
  13. CVE-2026-107249Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192—
  14. CVE-2026-107250ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193—
  15. CVE-2026-107251Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194—

The record

Busiest month
Oct 2026 so far, 1,731 CVEs
Oct 2026 so far
1,731 CVEs from 609 vendors
Deployment
Mixed, 49%
Monthly snapshots
293 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment