VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 138)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,163 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 138)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce<4.1.22Update to 4.1.22
CVE-2026-84901—
Medium6.616.1.2 - Authenticated (Administrator+) PHP Object Injection
Jetpack – AI Agents & MCP, Security, Backup & Analytics16.1 – 16.1.2Update to 16.1.3
——
Medium4.34.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News4.0.0 – 4.0.7Update to 4.0.8
CVE-2026-78150—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder<51.1.77Update to 51.1.77
CVE-2026-84896—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder<5.9.8Update to 5.9.8
CVE-2026-84022—
Medium6.5Authenticated (Contributor+) SQL Injection
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch<2.1.0Update to 2.1.0
CVE-2026-84937—
Medium5.3Unauthenticated Insecure Direct Object Reference
Accept Stripe Payments<2.1.4Update to 2.1.4
CVE-2026-81424—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Joli Table Of Contents – Table of Contents with Gutenberg Block & Shortcode<3.0.3Update to 3.0.3
CVE-2026-84931—
Medium4.34.6.3 - Missing Authorization
EmbedPress4.6.0 – 4.6.3Update to 4.6.4
CVE-2026-84926—
Critical9.82.3.22 - Unauthenticated Hook Injection
Post Grid2.2.85 – 2.3.22Update to 2.3.23
CVE-2024-11080—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
Pods – Custom Content Types and Fields≤3.3.9.1Update to 3.3.9.2
CVE-2026-76573—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
FooGallery Photo Gallery : Image, Video & Masonry Galleries≤3.3.2Update to 3.3.3
CVE-2026-85414—
High7.2Unauthenticated Stored Cross-Site Scripting via IP Address Header
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics≤1.10.2Update to 1.10.3
CVE-2026-83625—
Medium6.1Reflected Cross-Site Scripting via 'formData[id]' Parameter
Unlimited Elements for Elementor≤2.0.17Update to 2.0.18
CVE-2026-75586—
Medium6.5Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
WP File Download≤6.3.8Update to 6.3.9
CVE-2026-14975—
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Divi≤4.27.6Update to 4.27.7
CVE-2026-3853—
Medium5.0Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Divi≤4.27.6Update to 4.27.7
CVE-2026-4361—
High7.2Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.12.2Update to 2.12.3
CVE-2026-18406—
High7.2Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
Gravity Forms≤2.10.5Update to 3.0.0
CVE-2026-16649—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder
Anti-Spam, Spam FireWall by CleanTalk≤6.86Update to 6.87
CVE-2026-77830—
High8.8Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
Welcart e-Commerce≤2.12.1Update to 2.12.2
CVE-2026-19887—
High7.2Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
QuickCal≤1.0.20No patch available
CVE-2026-15984—
High7.2Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
W3 Total Cache≤2.10.5Update to 2.10.6
CVE-2026-78438—
High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.1Update to 3.15.2
CVE-2026-19769—
Medium6.1Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
Beaver Builder Plugin (Starter Version)≤2.11.0.1Update to 2.11.0.2
CVE-2026-18843—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.4Update to 3.13.5
CVE-2026-77263—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.4Update to 3.13.5
CVE-2026-77233—
Critical9.8Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
MStore API – Create Native Android & iOS Apps On The Cloud≤4.20.0Update to 4.21.1
CVE-2026-13447—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer≤2.4.30Update to 2.4.37
CVE-2026-8623—
Medium4.3Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
Theme My Login≤7.1.15Update to 7.2.0
CVE-2026-83628—

Search VulnCrest Radar

Jump to

Are you sure?