VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 121)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,163 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 121)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
Brizy – Page Builder≤2.8.14Update to 2.8.15
CVE-2026-2585—
Medium4.3Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.6.9Update to 5.6.10
CVE-2026-18441—
Medium4.9Authenticated (Administrator+) SQL Injection
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors≤2.7.2.1Update to 2.7.2.2
CVE-2026-66625—
Medium5.4Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Booking for Appointments and Events Calendar – Amelia≤2.4.4Update to 2.4.5
CVE-2026-14311—
Medium5.3Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Booking for Appointments and Events Calendar – Amelia≤2.4.5Update to 2.4.6
CVE-2026-16582—
Medium4.9Authenticated (Editor+) SQL Injection
SKT Addons for Elementor≤4.0Update to 4.1
CVE-2026-66626—
Medium4.9Authenticated (Shop Manager+) SQL Injection
WP-Lister Lite for eBay≤3.8.11Update to 3.8.12
CVE-2026-66628—
Medium4.9Authenticated (Administrator+) SQL Injection
Issues and Series for Newspapers, Magazines, Publishers, Writers≤3.1.3Update to 3.1.4
CVE-2026-66630—
Medium4.9Authenticated (Administrator+) SQL Injection
MoreConvert Wishlist for WooCommerce≤1.9.21Update to 2.0.0
CVE-2026-66631—
Medium5.3Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
Motors – Car Dealership & Classified Listings Plugin≤1.4.120Update to 1.4.121
CVE-2026-16750—
Medium5.32.1.6 - Unauthenticated Information Exposure
MgoSync – European dropshipping and suppliers2.1.5 – 2.1.6Update to 2.1.7
CVE-2026-92404—
Medium5.5Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium4.3Authenticated (Contributor+) Path Traversal via REST Templates Controller
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium4.3Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium4.3Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
Auto Upload Images≤3.3.2Update to 3.4.0
CVE-2026-12106—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Custom Twitter Feeds – A Tweets Widget or X Feed Widget≤2.8.0Update to 2.9.0
CVE-2026-84909—
Medium4.3Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium5.3Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI≤2.34.6Update to 2.34.7
CVE-2026-89278—
Medium4.3Forced Theme Install/Preview and Selector Injection via Theme Installer Route
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Low3.7HTML API set_modifiable_text() Comment Boundary Break
WordPress≤7.1Update to 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Low2.7Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)
WordPress≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
——
Medium5.3Missing Authorization
Botiga Pro≤1.6.4Update to 1.6.5
CVE-2026-86591—
High8.8Authenticated (Subscriber+) Arbitrary File Upload via Media Import
Use-your-Drive | Google Drive plugin for WordPress2.0 – 3.8.3Update to 3.9.0
CVE-2026-93031—
Medium5.3Missing Authorization
Mailchimp for WooCommerce≤6.1.0Update to 6.1.1
CVE-2026-92435—
Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar≤1.2.3Update to 1.2.4
CVE-2026-92425—
Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar≤1.2.2Update to 1.2.3
CVE-2026-92421—
Medium5.3Unauthenticated Payment Bypass
Payment Gateway for PayPal on WooCommerce≤9.2.0Update to 9.2.1
CVE-2026-92400—

Search VulnCrest Radar

Jump to

Are you sure?