VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 90)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 90)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3Missing Authorization
elegro Crypto Payment≤1.0.1No patch available
CVE-2026-94299—
Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway≤1.1.2No patch available
CVE-2026-94271—
Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway≤1.1.2No patch available
CVE-2026-94270—
High7.2Unauthenticated Stored Cross-Site Scripting
UpSolution Core≤8.44No patch available
CVE-2026-94166—
Medium5.3Unauthenticated Information Exposure
Slider Pro≤1.0.0No patch available
CVE-2026-86786—
Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce≤1.23.2Update to 1.23.3
CVE-2026-103337—
Medium4.3Cross-Site Request Forgery
Featured Image from URL (FIFU)≤6.0.7Update to 6.0.8
CVE-2026-96671—
High7.5Unauthenticated SQL Injection
tagDiv Opt-In Builder≤1.7.6Update to 1.7.7
CVE-2026-96330—
High7.5Pay Writer <= 12.0.1 - Unauthenticated SQL Injection
JNews - Pay Writer≤12.0.1Update to 12.0.2
CVE-2026-96328—
Medium6.5Authenticated (Subscriber+) SQL Injection
Taskbuilder – Project Management & Task Management Tool With Kanban Board≤6.0.5Update to 6.0.6
CVE-2026-95599—
Medium5.3Missing Authorization to Unauthenticated Settings Update
워드프레스 결제 심플페이 – 우커머스 결제 플러그인≤5.5.17Update to 5.5.18
CVE-2026-95597—
High7.2Unauthenticated Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS≤1.8.14Update to 1.8.15
CVE-2026-95591—
High7.2Unauthenticated Stored Cross-Site Scripting
JetBlog≤2.4.10Update to 2.4.10.1
CVE-2026-94661—
Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Pay with Vipps and MobilePay for WooCommerce≤6.2.0Update to 6.2.1
CVE-2026-94568—
Medium4.3Missing Authorization
File Media Renamer≤1.3No patch available
CVE-2026-94278—
Medium4.3Cross-Site Request Forgery
Wallstreet≤2.8.6No patch available
CVE-2026-39718—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
Twenty20 Image Before-After≤2.0.5Update to 2.0.6
CVE-2026-92767—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Beaver Builder Page Builder – Drag and Drop Website Builder≤2.11.0.5Update to 2.11.0.6
CVE-2026-92084—
Medium4.3Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)≤3.7.1Update to 3.7.2
CVE-2026-97343—
High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
Nelio Content – Editorial Calendar & Social Media Auto-Posting≤4.5.0Update to 4.5.1
CVE-2026-94505—
Medium6.1Reflected Cross-Site Scripting via 'thumb_url' Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery≤1.8.46Update to 1.8.47
CVE-2026-92974—
Medium6.1Reflected Cross-Site Scripting via REQUEST_URI
WPFront Notification Bar≤3.5.1Update to 3.5.2
CVE-2026-93896—
High7.2Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
WPC Product Options for WooCommerce≤4.0.5Update to 4.0.6
CVE-2026-97660—
Medium6.1Reflected Cross-Site Scripting via 'rule_data' Parameter
WPC Estimated Delivery Date for WooCommerce≤4.0.1Update to 4.0.2
CVE-2026-104313—
Medium5.4Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
WPMobile.App – Android and iOS App Builder≤11.84Update to 11.85
CVE-2026-103421—
Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-100157—
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-103519—
High7.5Unauthenticated SQL Injection via 'fullRef' Parameter
WP Visitor Statistics (Real Time Traffic)≤8.7Update to 8.7.1
CVE-2026-96267—
High7.2Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
Mail logging & Catcher≤2.1.12Update to 2.2.0
CVE-2026-93889—
High7.5Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System≤3.0.18Update to 3.0.19
CVE-2026-75028—

Search VulnCrest Radar

Jump to

Are you sure?