VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 94)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 94)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected DOM-Based Cross-Site Scripting via URL Pathname
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤5.0.1.1Update to 5.0.2
CVE-2026-85492—
High7.2Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
Relevanssi Premium≤2.31.4Update to 2.31.5
CVE-2026-103426—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Relevanssi – A Better Search≤4.28.3Update to 4.28.4
CVE-2026-97641—
Low3.1Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE≤3.2.6Update to 3.2.7
CVE-2026-102002—
High7.2Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
Newsletter – Send awesome emails from WordPress≤9.4.0Update to 9.4.1
CVE-2026-96566—
High7.2Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
MW WP Form≤5.1.7Update to 5.1.8
CVE-2026-96567—
High7.2Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect
No External Links≤5.2.0Update to 5.3.0
CVE-2026-95670—
High7.2Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
Mang Board≤2.4.2Update to 2.4.3
CVE-2026-96871—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings≤6.1.1Update to 6.1.2
CVE-2026-96647—
Medium5.3Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.1Update to 5.7.2
CVE-2026-94432—
High7.2Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
Kubio AI Page Builder≤2.9.2Update to 2.9.3
CVE-2026-100107—
Critical9.8Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
JSON API Auth≤3.1.2Update to 3.1.3
CVE-2026-97637—
High7.2Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.5.4Update to 3.6.6
CVE-2026-97342—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
GSpeech TTS – WordPress Text To Speech Plugin≤3.22.0Update to 3.22.1
CVE-2026-96578—
High7.2Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress≤4.13.0Update to 4.14.0
CVE-2026-93756—
Medium6.1Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
Greenshift – animation and page builder blocks≤13.2.0Update to 13.2.1
CVE-2026-93880—
Medium6.5Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
Event Tickets and Registration≤5.29.5Update to 5.29.5.1
CVE-2026-97634—
High7.2Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
Download Monitor≤5.2.10Update to 5.2.11
CVE-2026-100182—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Download Manager≤3.3.70Update to 3.3.71
CVE-2026-97338—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
DoFollow Case by Case≤3.6.0Update to 3.6.1
CVE-2026-95817—
Medium6.5Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions≤5.0.18Update to 5.0.19
CVE-2026-12951—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Customer Reviews for WooCommerce≤5.122.0Update to 5.123.0
CVE-2026-97663—
High7.2Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
CMB2≤2.13.1Update to 2.13.2
CVE-2026-102772—
High7.2Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
CMB2≤2.13.0Update to 2.13.1
CVE-2026-97336—
High7.2Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
BA Book Everything≤1.8.28Update to 1.8.29
CVE-2026-102565—
High7.2Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.4Update to 3.15.5
CVE-2026-90438—
High8.1File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
Ninja Forms - File Uploads≤3.3.34Update to 3.3.35
CVE-2026-92820—
High7.2Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
JetAppointment≤2.5.2.1Update to 2.5.3
CVE-2026-93875—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Autoptimize≤3.1.15.1Update to 3.1.16
CVE-2026-78471—
Medium6.1Reflected Cross-Site Scripting via 'lang' Parameter
Avada | Website Builder For WordPress & WooCommerce≤7.16.1Update to 7.16.2
CVE-2026-84925—

Search VulnCrest Radar

Jump to

Are you sure?