VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 144)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,163 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 144)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
Divi≤4.27.5Update to 4.27.7
CVE-2026-3850—
Critical9.8Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
SigmaForms Pro – AI Generated Forms≤1.4.11Update to 1.4.12
CVE-2026-78657—
High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
DevKit Pro≤2.3.0Update to 2.3.1
CVE-2026-14357—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
Divi≤4.27.6Update to 4.27.7
CVE-2026-3851—
High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
WP File Download≤6.3.4Update to 6.3.5
CVE-2026-14982—
High8.1Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
Gravity Forms≤3.0.2Update to 3.0.3
CVE-2026-19513—
High7.5Authenticated (Subscriber+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.10Update to 4.3.11
CVE-2026-81283—
Critical9.89.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
Booking for Appointments and Events Calendar – Amelia8.0 – 9.6.2Update to 9.6.3
CVE-2026-9055—
High7.2Unauthenticated Stored Cross-Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar≤5.13.1Update to 5.14
CVE-2026-81289—
High8.8Authenticated (Subscriber+) Remote Code Execution
WatchMan-Site7≤4.2.0No patch available
CVE-2026-77009—
Medium5.3Unauthenticated Information Exposure
Product Attachment for WooCommerce≤2.3.4Update to 2.3.5
CVE-2026-81774—
Medium6.1Reflected Cross-Site Scripting
MapGeo – Interactive Geo Maps≤1.6.30No patch available
CVE-2026-81770—
Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects≤4.5.1Update to 4.6
CVE-2026-82883—
Medium4.3Authenticated (Contributor+) Arbitrary CSS Injection
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor≤2.5.0Update to 2.5.1
CVE-2026-19698—
Critical9.8Unauthenticated Privilege Escalation
Authorizer≤3.15.1Update to 3.15.2
CVE-2026-81294—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤5.0.0.0Update to 5.0.0.1
CVE-2026-82884—
High7.2Unauthenticated Stored Cross-Site Scripting
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.≤3.1.5Update to 3.1.6
CVE-2026-81288—
Medium6.3Authenticated (Subscriber+) Privilege Escalation
Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress≤1.3.1No patch available
CVE-2026-81769—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress≤5.8.5Update to 5.8.6
CVE-2025-15692—
Medium5.3Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.22Update to 4.1.23
CVE-2026-82223—
Medium5.3Unauthenticated Payment Bypass
WP Express Checkout (Fast Payments via PayPal & Stripe)≤2.4.8Update to 2.4.9
CVE-2026-83533—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Xpro Addons — 150+ Widgets for Elementor≤1.7.3Update to 1.7.4
CVE-2026-83547—
High8.1Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
Ninja Forms - Layout & Styles≤3.0.31Update to 3.0.32
CVE-2026-81772—
High7.5Unauthenticated SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce≤3.8.1Update to 3.8.2
CVE-2026-81286—
Critical9.8Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
Nokri – Job Board WordPress Theme≤1.6.6Update to 1.6.7
CVE-2026-18550—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
WPBakery Page Builder≤8.7.4Update to 9.0
CVE-2026-15101—
High7.2Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
Welcart e-Commerce≤2.12.1Update to 2.12.2
CVE-2026-19914—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
Live Composer – Free WordPress Website Builder≤2.1.19Update to 2.1.20
CVE-2026-16786—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
Live Composer – Free WordPress Website Builder≤2.1.19Update to 2.1.20
CVE-2026-16788—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
Blocksy Companion≤2.1.51Update to 2.1.52
CVE-2026-18488—

Search VulnCrest Radar

Jump to

Are you sure?