VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 114)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,163 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 114)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More≤6.2.1Update to 6.2.2
CVE-2026-7622—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Live Composer – Free WordPress Website Builder≤2.1.21Update to 2.1.22
CVE-2026-16778—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
Hostel≤1.1.8No patch available
CVE-2026-1645—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
wpForo Forum≤3.1.5Update to 3.1.6
CVE-2026-91092—
High7.2Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
WP Yelp Review Slider≤9.2Update to 9.3
CVE-2026-93778—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory≤2.9.18Update to 2.9.19
CVE-2026-18345—
High7.12.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
WP Table Builder – Drag & Drop Table Builder2.1.1 – 2.1.13Update to 2.1.14
CVE-2026-6922—
High8.1Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard≤1.4.4Update to 1.4.5
CVE-2026-92969—
High7.2Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
WPC Product Bundles for WooCommerce≤8.6.6Update to 8.6.7
CVE-2026-93836—
Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Tutor LMS – eLearning and online course solution≤4.0.7Update to 4.0.8
CVE-2026-18439—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
RW Elephant Rental Inventory≤2.3.13Update to 2.4.0
CVE-2026-4123—
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Custom Field Template≤2.7.8Update to 2.8
CVE-2026-12995—
High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.3Update to 3.15.4
CVE-2026-94504—
High7.2Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
TranslatePress – Translate Multilingual sites with AI Translation≤3.3.5Update to 3.3.6
CVE-2026-89412—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
Contextual Related Posts≤4.4.1Update to 4.4.2
CVE-2026-85653—
High7.2Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
CMP – Coming Soon & Maintenance Plugin by NiteoThemes≤4.1.17Update to 4.1.18
CVE-2026-12470—
Medium6.1Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Booking Calendar≤11.8.3Update to 11.8.4
CVE-2026-93655—
Critical9.8Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Meta Box User Profile≤2.5.16Update to 2.6.0
CVE-2026-13355—
Critical9.8Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Give Tributes≤2.3.1Update to 2.3.1.1
CVE-2026-19658—
Medium4.9Authenticated (Administrator+) SQL Injection
HashBar – Announcement, Notification Bar & Popup Campaign≤2.0.3Update to 2.0.4
CVE-2026-94117—
Medium4.3Missing Authorization
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder≤5.3Update to 5.4
CVE-2026-86842—
Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads3.1.0 – 8.9.4Update to 8.9.5
CVE-2026-84098—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JSM Show Post Metadata≤4.9.0Update to 4.9.1
CVE-2026-88997—
Medium4.3Missing Authorization
Paymob for WooCommerce≤4.1.13Update to 4.1.14
CVE-2026-87981—
Medium4.38.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads8.5 – 8.9.4Update to 8.9.5
CVE-2026-77766—
Medium5.36.17.4.1 - Unauthenticated Information Exposure
The Events Calendar4.5 – 6.17.4.1Update to 6.17.5
CVE-2026-84741—
Medium5.3Unauthenticated Information Exposure
WPC Smart Compare for WooCommerce≤6.6.0Update to 6.6.1
CVE-2026-90985—
High7.5Unauthenticated SQL Injection
JetFormBuilder Stripe Gateway≤1.0.0Update to 1.1.0
CVE-2022-4997—
Medium5.3Unauthenticated Information Exposure
NP Quote Request for WooCommerce≤2.4.15Update to 2.4.16
CVE-2026-93528—
Medium4.3Missing Authorization
WC Fields Factory≤4.1.10Update to 4.1.11
CVE-2026-93507—

Search VulnCrest Radar

Jump to

Are you sure?