VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 12)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,172 results

WordPress vulnerabilities listed in CISA KEV (page 12)
SeverityVulnerabilityCVEInstallsPublished
High8.8Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters
QA Assistants – Driven by data≤5.3.0Update to 5.3.0.1
CVE-2026-87112—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI≤8.1.1Update to 8.1.2
CVE-2026-121792—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder≤2.18.0Update to 2.20.0
CVE-2026-118800—
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder≤2.18.0Update to 2.20.0
CVE-2026-118801—
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints
Tutor LMS – eLearning and online course solution≤4.1.2Update to 4.1.3
CVE-2026-93779—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass
TranslatePress – Translate Multilingual sites with AI Translation≤3.3.8Update to 3.3.9
CVE-2026-119167—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields
Soledad≤8.7.7Update to 8.7.8
CVE-2026-93902—
Medium4.7Unauthenticated Stored Cross-Site Scripting via 'author' Parameter
Stop Spammers Classic≤2026.6Update to 2026.7
CVE-2026-120477—
Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
WCFM – Frontend Manager for WooCommerce≤6.8.1Update to 6.8.2
CVE-2026-61987—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter
Stackable – Page Builder Gutenberg Blocks≤3.19.9Update to 3.19.10
CVE-2026-9601—
High7.5Unauthenticated SQL Injection via 'email' Parameter
Affiliate Program Suite — SliceWP Affiliates≤1.2.14Update to 1.2.15
CVE-2026-120043—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name
Redux Framework≤4.5.16Update to 4.5.17
CVE-2026-110534—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action
Redux Framework≤4.5.16Update to 4.5.17
CVE-2026-110705—
Medium4.3Missing Authorization
Dynific Addons for Elementor (formerly Anywhere Elementor)≤1.3.0Update to 1.3.1
CVE-2026-114186—
Medium6.5Authenticated (Subscriber+) SQL Injection
Dynific Addons for Elementor (formerly Anywhere Elementor)≤1.3.0Update to 1.3.1
CVE-2026-114189—
High7.3Unauthenticated Privilege Escalation
Melapress Role Editor≤1.3.0Update to 1.4.0
CVE-2026-109900—
Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder≤6.2.16Update to 6.2.17
CVE-2026-120858—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Dynific Addons for Elementor (formerly Anywhere Elementor)≤1.3.0Update to 1.3.1
CVE-2026-114188—
Medium4.3Missing Authorization
Melapress Role Editor≤1.3.0Update to 1.4.0
CVE-2026-109899—
Medium6.1Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie
QODE Wishlist for WooCommerce≤1.2.9Update to 1.3.0
CVE-2026-121516—
Critical9.8Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter
Printcart Store – Web to Print Product Designer for WooCommerce≤2.13.2Update to 2.13.3
CVE-2026-19803—
Medium6.5Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters
Active Woot Products Tables for WooCommerce. 100% FREE ≤2.1.5Update to 2.1.6
CVE-2026-120560—
High7.2Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar
Pie Register – User Registration, Profiles & Content Restriction≤3.8.4.16Update to 3.8.4.17
CVE-2026-119158—
High7.2Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization≤4.2.18Update to 4.2.19
CVE-2026-120739—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization≤4.2.18Update to 4.2.19
CVE-2026-120677—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization≤4.2.17Update to 4.2.18
CVE-2026-119070—
Critical9.8Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
payever Checkout – Composable Payment Gateway≤4.8.0Update to 4.9.0
CVE-2026-93754—
Medium5.9Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name
Noptin – Newsletter, New Post Notifications & Email Automation≤4.4.3Update to 4.4.4
CVE-2026-119616—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Flying Images: Optimize and Lazy Load Images for Faster Page Speed≤2.4.15Update to 2.4.16
CVE-2026-119175—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter
Motors – Car Dealership & Classified Listings Plugin≤1.4.128Update to 1.4.129
CVE-2026-116562—

Search VulnCrest Radar

Jump to

Are you sure?