VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 134)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,163 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 134)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
Checkout Custom Fields Builder for WooCommerce≤1.1.5Update to 1.1.6
CVE-2026-19802—
Medium5.3Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
WP Compress – Instant Performance & Speed Optimization≤7.22.01Update to 7.22.38
CVE-2026-120551—
High8.1Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
Next-Cart Store to WooCommerce Migration≤3.9.8Update to 3.9.9
CVE-2026-76009—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
ilGhera Reviso Exporter for WooCommerce≤1.2.3Update to 1.2.4
CVE-2026-8615—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell≤3.12.13Update to 3.13.0
CVE-2026-84908—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
Awesome Support – WordPress HelpDesk & Support Plugin≤6.3.9Update to 6.4.0
CVE-2026-19946—
High7.2Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤8.7.3Update to 8.7.4
CVE-2026-835935K+
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode
WP Recipe Maker≤10.8.0Update to 10.8.1
CVE-2026-75905—
Medium5.4Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.17Update to 4.1.18
CVE-2026-11821—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
WP Crowdfunding≤2.2.1Update to 2.2.2
CVE-2026-19945—
Medium4.9Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
WP Crowdfunding≤2.2.1Update to 2.2.2
CVE-2026-19944—
Medium6.1Reflected Cross-Site Scripting via 'tab_group_section' Parameter
User Access Manager≤2.3.18Update to 2.3.19
CVE-2026-19797—
High7.2Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
WP EasyCart: Shopping Cart and eCommerce Store≤5.9.3Update to 5.9.4
CVE-2026-17553—
Medium6.1Reflected Cross-Site Scripting via 'wpf_fid' Parameter
Product Filter for WooCommerce by WBW≤3.4.2Update to 3.4.3
CVE-2026-7804—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
Podlove Podcast Publisher≤4.5.5Update to 4.5.6
CVE-2026-75966—
Medium4.9Authenticated (Custom+) SQL Injection via 'status' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance≤1.31.0Update to 1.31.1
CVE-2026-19800—
Medium6.6Authenticated (Administrator+) PHP Object Injection via Form Import
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.14.6Update to 3.14.7
CVE-2026-11363—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
My Calendar – Accessible Event Manager≤3.8.3Update to 3.8.4
CVE-2026-77186—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
My Calendar – Accessible Event Manager≤3.8.3Update to 3.8.4
CVE-2026-77187—
High8.8Authenticated (Author+) Remote Code Execution to Privilege Escalation
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment≤3.1.10Update to 3.1.11
CVE-2026-76801—
High7.5Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.22Update to 4.1.23
CVE-2026-15667—
High7.5Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.22Update to 4.1.23
CVE-2026-15406—
High7.2Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress≤1.7.5Update to 1.7.6
CVE-2026-13359—
High7.216.1.2 - Unauthenticated Stored Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics16.1 – 16.1.2Update to 16.1.3
——
Medium5.3Captcha Bypass
Simple CAPTCHA with Cloudflare Turnstile≤1.42.1Update to 1.42.3
CVE-2026-66674—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.22Update to 4.1.23
CVE-2026-12956—
High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin≤2.3.3Update to 2.3.4
CVE-2026-84819—
High7.2Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values
Repeater Fields for Gravity Forms≤3.0.4Update to 3.1.0
CVE-2026-84293—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Update
WP-Stateless – Google Cloud Storage≤4.4.1Update to 4.4.2
CVE-2026-81801—
Medium5.3Missing Authorization
Return Refund and Exchange For WooCommerce≤4.6.4Update to 4.6.5
CVE-2026-81799—

Search VulnCrest Radar

Jump to

Are you sure?