VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 11)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,172 results

WordPress vulnerabilities listed in CISA KEV (page 11)
SeverityVulnerabilityCVEInstallsPublished
Critical9.8Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization
Naimur Email OTP Verification for WooCommerce≤2.1.0Update to 2.1.1
CVE-2026-104014—
Medium5.4Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain
Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials≤4.1.0Update to 4.1.1
CVE-2026-120685—
High7.5Unauthenticated SQL Injection via 'tag' Parameter Array Keys
Booking for Appointments and Events Calendar – Amelia Pro4.0 – 9.9.1Update to 9.9.2
CVE-2026-116751—
High7.2Unauthenticated Stored Cross-Site Scripting via Text Field Array Value
WS Form LITE – Drag & Drop Contact Form Builder≤1.12.18Update to 1.12.19
CVE-2026-122231—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name
WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100)≤2.6.10Update to 2.6.11
CVE-2026-118784—
Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter
Zephyr Project Manager≤3.3.209Update to 3.3.210
CVE-2026-120514—
Medium5.3Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php
YML for Yandex Market≤5.10.0Update to 5.11.0
CVE-2026-120548—
High7.5Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint
Booking for Appointments and Events Calendar – Amelia9.0 – 9.9.1Update to 9.9.2
CVE-2026-107616—
High7.5Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
wpForo Forum≤3.2.2Update to 3.2.3
CVE-2026-119164—
High7.5Unauthenticated SQL Injection via 'data' Parameter
wpForo Forum≤3.2.1Update to 3.2.2
CVE-2026-95870—
High8.1Unauthenticated Privilege Escalation to 'data[args][role]' Parameter
WPJAM Basic≤7.1Update to 7.1.2
CVE-2026-103900—
Medium6.5Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint
Booking for Appointments and Events Calendar – Amelia9.0 – 9.9.1Update to 9.9.2
CVE-2026-104992—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms
wpForo Forum≤3.2.2Update to 3.2.3
CVE-2026-120532—
High7.5Unauthenticated SQL Injection via 'href[locale]' Parameter
wpForo Forum≤3.2.2Update to 3.2.3
CVE-2026-119155—
Medium6.5Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter
wpForo Forum≤3.2.2Update to 3.2.3
CVE-2026-110004—
High8.1Unauthenticated PHP Object Injection via $_POST Parameters
Advanced Form Integration — Connect Forms to 300+ Apps≤2.10.2Update to 2.10.3
CVE-2026-104738—
Medium5.7Authenticated (Subscriber+) SQL Injection via User Profile Biography
WebToffee WP Backup and Migration≤1.6.1Update to 1.6.2
CVE-2026-120530—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters
SEOPress – AI SEO Plugin & On-site SEO≤10.3Update to 10.4
CVE-2026-120515—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps≤5.5.89Update to 5.5.90
CVE-2026-118204—
Medium5.3Authenticated (Subscriber+) SQL Injection via 'engine' Parameter
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps≤5.5.90Update to 5.5.91
CVE-2026-121536—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps≤5.5.90Update to 5.5.91
CVE-2026-120479—
Medium5.3Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint
Paystack WooCommerce Payment Gateway≤5.8.5Update to 5.8.6
CVE-2026-93370—
High7.2Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard
AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia≤9.2.41Update to 9.2.42
CVE-2026-122037—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps≤5.5.89Update to 5.5.90
CVE-2026-118048—
High7.2Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget
Unlimited Elements for Elementor≤2.0.26Update to 2.0.28
CVE-2026-116558—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.14.1Update to 2.14.2
CVE-2026-116621—
Medium5.9Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter
Vanquish Upload Files for WooCommerce≤2.7.13Update to 2.8.0
CVE-2026-122265—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint
TranslatePress – Translate Multilingual sites with AI Translation≤3.3.8Update to 3.3.9
CVE-2026-120537—
Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker≤11.2.7Update to 11.2.8
CVE-2026-103917—
High7.2Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter
Strong Testimonials≤3.3.16Update to 3.3.17
CVE-2026-115811—

Search VulnCrest Radar

Jump to

Are you sure?