VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 25)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 25)
SeverityVulnerabilityCVEInstallsPublished
High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Independent Analytics Pro≤2.15.5Update to 2.16.0
CVE-2026-104744—
High7.5Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.3.1Update to 1.58.0
CVE-2026-97638—
High7.5Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
Email Templates Customizer and Designer for WordPress and WooCommerce≤1.5.14Update to 1.5.15
CVE-2026-107630—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
CP Multi View Events Calendar≤1.4.43Update to 1.4.44
CVE-2026-119176—
High7.2Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution≤2.8.4Update to 2.8.5
CVE-2026-112365—
High7.2Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce≤1.17.10Update to 1.17.11
CVE-2026-96894—
Medium4.3Cross-Site Request Forgery
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce≤4.7.5Update to 4.7.6
CVE-2026-119466—
Medium4.3Cross-Site Request Forgery
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini≤3.8.8Update to 3.8.9
CVE-2026-65566—
Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads≤2.8.19Update to 2.8.20
CVE-2026-102905—
High8.1Unauthenticated Arbitrary File Upload via Avada Form Upload Field
Avada | Website Builder For WordPress & WooCommerce≤7.16.2Update to 7.16.4
CVE-2026-115346—
Medium6.5Unauthenticated Shortcode Injection via 'pagination_info' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.198Update to 2.8.199
CVE-2026-118635—
Medium4.3Missing Authorization
Event Tickets and Registration≤5.30.2Update to 5.30.3
CVE-2026-62055—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Player Addons for Elementor – Audio and Video Widgets for Elementor≤1.1.10Update to 1.1.11
CVE-2026-119365—
Medium4.3Missing Authorization
The Events Calendar≤6.18.2Update to 6.18.3
CVE-2026-119367—
Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
JS Help Desk – AI-Powered Support & Ticketing System≤5.0.1Update to 5.0.2
CVE-2026-104739—
High7.2Unauthenticated Stored Cross-Site Scripting
Iptanus File Upload≤5.2.1Update to 5.2.2
CVE-2026-66570—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
Photo Engine (Media Organizer & Lightroom)≤6.5.7Update to 6.5.8
CVE-2026-120575—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress≤0.9.9Update to 1.0.0
CVE-2026-120552—
Medium6.5Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
Meow Gallery≤5.5.4Update to 5.5.5
CVE-2026-13747—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
Themify Builder≤7.8.4Update to 7.8.5
CVE-2026-115869—
High8.1Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤3.7.2Update to 3.7.3
CVE-2026-120538—
Medium4.3Missing Authorization
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution≤3.2.6Update to 3.3.0
CVE-2026-62141—
High7.5Unauthenticated SQL Injection
Bookit — Booking & Appointment Calendar≤2.6.0.6Update to 2.6.0.7
CVE-2026-62048—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar≤6.18.2Update to 6.18.3
CVE-2026-119369—
Medium4.3Missing Authorization
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar≤6.5.4Update to 6.5.5
CVE-2026-116407—
Medium5.3Missing Authorization
The Events Calendar≤6.18.2Update to 6.18.3
CVE-2026-119368—
High8.1Unauthenticated Account Takeover
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments≤4.9.5Update to 4.9.6
CVE-2026-120574—
Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.7.1Update to 3.6.8
CVE-2026-119482—
High7.4Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
Essential Addons for Elementor – Popular Elementor Templates & Widgets≤6.8.7Update to 6.8.8
CVE-2026-118205—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA≤1.1.16Update to 1.1.17
CVE-2026-109592—

Search VulnCrest Radar

Jump to

Are you sure?