VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 60)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 60)
SeverityVulnerabilityCVEInstallsPublished
High7.2Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
Contact Form DB for Enfold≤2.0.2No patch available
CVE-2026-83592—
Critical9.1Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
BuddyPress XProfile Custom Image Field≤3.1.0No patch available
CVE-2026-120518—
Critical9.8Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
AGE-GATE≤1.0No patch available
CVE-2026-104800—
Critical9.8Unauthenticated Arbitrary File Upload via 'image.push' Method
JTL-Connector for WooCommerce≤2.4.3No patch available
CVE-2026-87855—
Medium4.7Reflected Cross-Site Scripting via 'tab' Parameter
Tutor LMS – eLearning and online course solution≤4.1.0Update to 4.1.1
CVE-2026-100193—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
FV Player 8≤8.1.7Update to 8.1.8
CVE-2026-95807—
High7.2Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
FV Flowplayer Video Player≤7.5.54.7212Update to 7.5.55.7212
CVE-2026-97398—
Medium5.3Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
Avada (Fusion) Builder≤3.16.1Update to 3.16.2
CVE-2026-97471—
High7.5Unauthenticated SQL Injection via 'inputs' Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.48Update to 1.15.49
CVE-2026-95808—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
Directorist: AI-Powered Business Directory, Listings & Classified Ads≤8.10.2.1Update to 8.10.3
CVE-2026-100185—
High7.2Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
AnyComment≤0.3.6No patch available
CVE-2026-103422—
Critical9.8Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Abandoned Cart Pro for WooCommerce≤10.8.0Update to 10.8.1
CVE-2026-97668—
High7.5Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
Abandoned Cart Pro for WooCommerce≤10.8.0Update to 10.8.1
CVE-2026-102251—
Critical9.8Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
Abandoned Cart Pro for WooCommerce≤10.8.0Update to 10.8.1
CVE-2026-97657—
Critical9.8Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
Snazzy Social Media Feed≤2.5No patch available
CVE-2026-110002—
Critical9.8Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
Printcart Store – Web to Print Product Designer for WooCommerce≤2.9.1Update to 2.9.2
CVE-2026-93388—
High8.1Unauthenticated PHP Object Injection
Ozisti | Augmented Reality WooCommerce Theme≤1.1.10No patch available
CVE-2026-54860—
High8.1Unauthenticated PHP Object Injection
Preservation≤1.15No patch available
CVE-2026-54859—
High8.1Unauthenticated PHP Object Injection
Printy≤1.13.0No patch available
CVE-2026-54858—
High8.1Cryptocurrency & Coin ICO WordPress <= 1.2.6 - Unauthenticated PHP Object Injection
RexCoin - Cryptocurrency & Coin ICO WordPress≤1.2.6No patch available
CVE-2026-54856—
High7.5Authenticated (Contributor+) PHP Object Injection
Link Whisper Free≤0.9.7Update to 0.9.8
CVE-2026-109686—
Medium6.1Reflected Cross-Site Scripting
Link Whisper Free≤0.9.7Update to 0.9.8
CVE-2026-109685—
High7.3Unauthenticated Privilege Escalation
ACF Frontend Admin by DynamiApps≤3.29.13Update to 3.30.0
CVE-2026-109892—
Medium6.6Authenticated (Shop Manager+) PHP Object Injection
YayMail – WooCommerce Email Customizer≤4.4.6Update to 4.4.7
CVE-2026-42701—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.2.8Update to 5.3.0
CVE-2026-105882—
High7.5Unauthenticated SQL Injection
Link Whisper Free≤0.9.7Update to 0.9.8
CVE-2026-109688—
Medium5.3Unauthenticated Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar≤6.5.2Update to 6.5.3
CVE-2026-107416—
High7.5Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
Membership & User Roles for WooCommerce (Automatic Role Changer)≤20260828Update to 20261007
CVE-2026-104767—
High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
Directorist: AI-Powered Business Directory, Listings & Classified Ads≤8.10.2.1Update to 8.10.3
CVE-2026-17092—
Medium5.3Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
Database Addon for Contact Form 7 – CFDB7≤1.4.1Update to 1.4.2
CVE-2026-107652—

Search VulnCrest Radar

Jump to

Are you sure?