VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 137)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 137)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Divi≤4.27.6Update to 4.27.7
CVE-2026-3853—
Medium5.0Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Divi≤4.27.6Update to 4.27.7
CVE-2026-4361—
High7.2Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.12.2Update to 2.12.3
CVE-2026-18406—
High7.2Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
Gravity Forms≤2.10.5Update to 3.0.0
CVE-2026-16649—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder
Anti-Spam, Spam FireWall by CleanTalk≤6.86Update to 6.87
CVE-2026-77830—
High8.8Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
Welcart e-Commerce≤2.12.1Update to 2.12.2
CVE-2026-19887—
High7.2Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
QuickCal≤1.0.20No patch available
CVE-2026-15984—
High7.2Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
W3 Total Cache≤2.10.5Update to 2.10.6
CVE-2026-78438—
High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.1Update to 3.15.2
CVE-2026-19769—
Medium6.1Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
Beaver Builder Plugin (Starter Version)≤2.11.0.1Update to 2.11.0.2
CVE-2026-18843—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.4Update to 3.13.5
CVE-2026-77263—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.4Update to 3.13.5
CVE-2026-77233—
Critical9.8Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
MStore API – Create Native Android & iOS Apps On The Cloud≤4.20.0Update to 4.21.1
CVE-2026-13447—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer≤2.4.30Update to 2.4.37
CVE-2026-8623—
Medium4.3Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
Theme My Login≤7.1.15Update to 7.2.0
CVE-2026-83628—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
Social Chat – Click To Chat App Button≤8.6.2Update to 8.6.3
CVE-2026-18404—
Critical9.8Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN≤3.21.0Update to 3.21.1
CVE-2026-83627—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer≤2.4.30Update to 2.4.37
CVE-2026-8625—
Medium4.9Authenticated (Administrator+) SQL Injection
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode<4.4.2Update to 4.4.2
CVE-2026-82186—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Woodmart<8.3.8Update to 8.3.8
CVE-2026-27086—
Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell<3.13.0Update to 3.13.0
CVE-2025-15691—
High7.2Authenticated (Administrator+) Remote Code Execution
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN<3.21.2Update to 3.21.2
CVE-2026-19224—
Medium4.9Authenticated (Shop Manager+) SQL Injection
WooCommerce≤10.9.4Update to 11.0
CVE-2026-57777—
Medium5.45.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
LearnDash LMS4.25.0 – 5.1.6Update to 5.1.6.1
CVE-2026-12843—
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads<8.9Update to 8.9
CVE-2026-84066—
Critical9.8Unauthenticated PHP Object Injection in Arbitrary Form Fields
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance≤1.31.0Update to 1.31.1
CVE-2026-10196—
Medium5.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace≤2.11.11Update to 2.12.0
CVE-2026-32480—
Medium6.4Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Ninja Forms - Scheduled Exports≤3.0.3Update to 3.0.4
CVE-2026-87870—
Medium5.3Unauthenticated Information Exposure
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell<3.13.0Update to 3.13.0
CVE-2026-79631—
Medium5.3Missing Authorization
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)<4.5.1.2Update to 4.5.1.2
CVE-2026-17517—

Search VulnCrest Radar

Jump to

Are you sure?