VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 66)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 66)
SeverityVulnerabilityCVEInstallsPublished
High8.1Unauthenticated PHP Object Injection
Motorix≤1.11No patch available
CVE-2026-62004—
High8.1Unauthenticated PHP Object Injection
Meals & Wheels≤1.1.13No patch available
CVE-2026-62002—
High8.1Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
Marcell - Personal Blog & Magazine WordPress Theme≤1.2.14No patch available
CVE-2026-62001—
High8.1Unauthenticated PHP Object Injection
Legal Stone | Lawyers & Attorneys WordPress Theme≤1.2.11No patch available
CVE-2026-61997—
High7.2Unauthenticated Stored Cross-Site Scripting
Auction Nudge – Your eBay Listings≤8.4.0No patch available
CVE-2026-61988—
High7.2Unauthenticated Stored Cross-Site Scripting
JetProductTables≤1.2.4Update to 1.2.4.1
CVE-2026-107867—
Medium4.37.1 - Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments6.1 – 7.1Update to 7.2
CVE-2026-107791—
Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions≤5.0.19No patch available
CVE-2026-108695—
Medium4.3Missing Authorization
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce≤2.2.4Update to 2.2.5
CVE-2026-103685—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool≤3.0.0Update to 4.0.0
CVE-2025-15703—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
PeproDev Ultimate Profile Solutions≤8.2.36Update to 8.2.37
CVE-2026-4791—
High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
HivePress – Business Directory, Listings & Classified Ads Plugin≤1.7.31Update to 1.7.32
CVE-2026-107657—
Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings≤6.1.2Update to 6.2.0
CVE-2026-104722—
High7.5Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Divi Plus≤2.4.0Update to 2.4.1
CVE-2026-91136—
High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress≤5.2.12Update to 5.3.0
CVE-2026-101920—
High7.2Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout≤3.16.0.5Update to 3.16.0.6
CVE-2026-100147—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI≤5.8.4Update to 5.8.5
CVE-2026-104728—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Avada | Website Builder For WordPress & WooCommerce≤7.16.1Update to 7.16.2
CVE-2026-97340—
High7.2Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
WPAdverts – Classifieds Plugin≤2.3.4Update to 2.3.5
CVE-2026-100178—
High7.5Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.2Update to 5.7.3
CVE-2026-96662—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
Email Marketing for WordPress and WooCommerce – Retainful≤1.0.10Update to 1.0.11
CVE-2026-97396—
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
SureDash – Community, Courses & Member Dashboard≤1.12.1Update to 1.12.2
CVE-2026-1027741K+
High7.2Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)≤44.1Update to 45.0
CVE-2026-96765—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
Motors – Car Dealership & Classified Listings Plugin≤1.4.124Update to 1.4.125
CVE-2026-96563—
High7.5Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels≤5.0.2Update to 5.0.3
CVE-2026-93746—
High8.1Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)≤44.1Update to 45.0
CVE-2026-104759—
Medium4.7Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More≤2.0.2.1Update to 2.0.2.2
CVE-2026-101921—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
WP Directory Kit≤1.5.9Update to 1.6.0
CVE-2026-96653—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Premium Packages – Sell Digital Products Securely≤7.2.6Update to 7.2.7
CVE-2026-103478—
Critical9.8Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
WPCOM Member≤1.7.27Update to 1.8.0
CVE-2026-104803—

Search VulnCrest Radar

Jump to

Are you sure?