VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 135)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 135)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3Unauthenticated Information Exposure
Tangible: Loops & Logic≤4.2.0Update to 4.3.0
CVE-2026-16960—
Medium4.9Authenticated (Administrator+) SQL Injection
Quentn WP≤1.2.14Update to 1.2.15
CVE-2026-84113—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More≤3.0.8Update to 3.0.9
CVE-2026-85418—
Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode≤4.4.1Update to 4.4.2
CVE-2026-85133—
Medium5.3Unauthenticated Information Exposure
Payment Plugins for PayPal WooCommerce≤2.0.25Update to 2.0.26
CVE-2026-80340—
Medium4.34.4.1 - Missing Authorization to Information Exposure
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode4.0.2 – 4.4.1Update to 4.4.2
CVE-2026-85132—
Medium6.50.1.8 - Unauthenticated Arbitrary Shortcode Execution
LukasApps CAPTCHA tools for Contact Form 70.1.7 – 0.1.8Update to 0.1.9
CVE-2026-85117—
Medium5.3Unauthenticated Insecure Direct Object Reference
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers≤3.6Update to 3.7
CVE-2026-85037—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
HT Menu – WordPress Mega Menu Builder for Elementor<1.2.7Update to 1.2.7
CVE-2026-84935—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JCH Optimize<6.0.1Update to 6.0.1
CVE-2026-84934—
Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode≤4.4.1Update to 4.4.2
CVE-2026-82185—
Medium5.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode≤4.4.1Update to 4.4.2
CVE-2026-82184—
Medium6.1Unauthenticated Open Redirect
Groundhogg — CRM, Newsletters, and Marketing Automation<4.7.2Update to 4.7.2
CVE-2026-81741—
Medium6.5Unauthenticated Arbitrary Shortcode Execution
Hustle – Email Marketing, Lead Generation, Optins, Popups<7.8.14.2Update to 7.8.14.2
CVE-2026-80440—
Medium4.3Missing Authorization
Payment Plugins for PayPal WooCommerce≤2.0.25Update to 2.0.26
CVE-2026-80341—
Medium5.3Unauthenticated Information Exposure
Payment Plugins for Stripe WooCommerce≤4.0.11Update to 4.0.12
CVE-2026-80339—
High7.33.0.2 - Unauthenticated Privilege Escalation
SEO Flow by LupsOnline3.0.0 – 3.0.2Update to 3.0.3
CVE-2026-78362—
High7.5Missing Authorization to Unauthenticated Stripe Credentials Update
Event Tickets and Registration≤5.27.4Update to 5.27.4.1
CVE-2026-3174—
Medium5.3Unauthenticated Information Exposure
JetFormBuilder — Dynamic Blocks Form Builder<3.6.5.2Update to 3.6.5.2
CVE-2026-19858—
Medium6.5Unauthenticated Arbitrary Shortcode Execution
Anti-Spam, Spam FireWall by CleanTalk<6.87Update to 6.87
CVE-2026-19855—
High8.8Authenticated (Subscriber+) Arbitrary Account Email Takeover
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments<4.6.3Update to 4.6.3
CVE-2026-18480—
Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine≤12.0.1Update to 12.0.2
CVE-2026-18042—
Medium5.3Unauthenticated Insecure Direct Object Reference
WP Travel – Ultimate Travel Booking System, Tour Management Engine≤12.0.1Update to 12.0.2
CVE-2026-13146—
Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine≤12.0.1Update to 12.0.2
CVE-2026-13144—
Medium5.4Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
Flamingo≤2.6.2Update to 2.6.3
CVE-2026-12853—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
Powerkit – Supercharge your WordPress Site≤3.0.4Update to 3.0.5
CVE-2026-2390—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder<5.9.9Update to 5.9.9
CVE-2026-84028—
Medium5.3Missing Authorization to Unauthenticated Purchase Verification Bypass
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE≤3.1.7Update to 3.1.8
CVE-2026-4945—
High7.2Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor≤3.15.7Update to 3.15.8
CVE-2026-6431—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates≤2.2.0Update to 2.2.1
CVE-2026-8279—

Search VulnCrest Radar

Jump to

Are you sure?