Database
WordPress Vulnerability Database (page 174)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Missing Authorization | CVE-2026-18035 | — | |
| Medium5.3 | Unauthenticated Information Exposure | CVE-2026-66463 | — | |
| Medium4.3 | Information Exposure to Authenticated (Subscriber+) Arbitrary User/Post/Term Meta Disclosure | CVE-2026-18943 | — | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection | CVE-2026-16977 | — | |
| Critical9.1 | Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion | CVE-2026-18048 | — | |
| Medium5.3 | Missing Authorization | CVE-2026-66689 | — | |
| Medium6.4 | Authenticated (Subscriber+) Server-Side Request Forgery | CVE-2026-19050 | — | |
| Medium5.3 | Unauthenticated Information Exposure | CVE-2026-66462 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2026-66697 | — | |
| Medium5.3 | Missing Authorization | CVE-2026-66691 | — | |
| Medium5.3 | Missing Authorization | CVE-2026-27345 | — | |
| Medium6.4 | Authenticated (Customer+) Stored Cross-Site Scripting | CVE-2026-66687 | — | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting | CVE-2026-66471 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2026-66698 | 1K+ | |
| Medium5.3 | Missing Authorization | CVE-2026-66464 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2026-15039 | — | |
| Medium4.3 | Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure | CVE-2026-14858 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-19217 | — | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection | CVE-2026-18230 | — | |
| Medium6.1 | Unauthenticated Reflected Cross-Site Scripting via log Parameter WordPress≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3 | CVE-2026-64638 | — | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Parent/Menu Order Modification | CVE-2026-9676 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element WordPress≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3 | — | — | |
| Medium5.4 | Cross-Site Scripting via display_id from Sigmative API Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons≤4.4.5Update to 4.4.6 | CVE-2026-92991 | — | |
| Medium4.3 | Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite WordPress≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3 | — | — | |
| Medium4.3 | Missing Authorization | CVE-2026-14548 | — | |
| Medium4.9 | Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit WordPress≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3 | CVE-2026-114570 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2026-61982 | — | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3 | — | — | |
| Medium5.5 | Authenticated (Author+) CSS Injection WordPress≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3 | — | — | |
| Medium4.3 | Authenticated (Subscriber+) Email Change Confirmation Bypass WordPress≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3 | — | — |
- Medium5.3Missing Authorization
User Access Manager
≤2.3.14Update to 2.3.15
- Medium5.3Unauthenticated Information Exposure
iCARRY
≤2.9No patch available
- Medium4.3Information Exposure to Authenticated (Subscriber+) Arbitrary User/Post/Term Meta Disclosure
WPC Admin Columns
≤2.3.3Update to 2.3.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.44Update to 1.15.45
- Critical9.1Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion
WP Photo Album Plus
≤9.2.07.1Update to 9.2.07.002
- Medium5.3Missing Authorization
Anti Spam and list cleaner – AcyChecker
≤2.0.0Update to 2.0.1
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
ProSolution WP Client
≤2.0.8Update to 2.0.9
- Medium5.3Unauthenticated Information Exposure
WooCommerce Appointments
≤5.3.8No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Colissimo shipping methods for WooCommerce
≤2.10.0Update to 3.0.0
- Medium5.3Missing Authorization
Nokri – Job Board WordPress Theme
≤1.6.6Update to 1.6.7
- Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce
≤2.0.3Update to 2.0.5
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager
≤1.3.2Update to 1.4.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Accordions – Responsive Accordion & FAQ Plugin for WordPress
≤3.0.6Update to 3.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
SureDash – Community, Courses & Member Dashboard
≤1.10.1Update to 1.10.2
- Medium5.3Missing Authorization
Website Internal Link Optimiser
≤5.2.7No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Gift Cards For WooCommerce Pro
≤4.2.9Update to 4.2.10
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure
WP Crowdfunding
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1064Update to 1.7.1065
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Directory Kit
≤1.5.5Update to 1.5.6
- Medium6.1Unauthenticated Reflected Cross-Site Scripting via log Parameter
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Parent/Menu Order Modification
F4 Post Tree
≤2.0.4Update to 2.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3
- Medium5.4Cross-Site Scripting via display_id from Sigmative API
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.4.5Update to 4.4.6
- Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3
- Medium4.3Missing Authorization
Ray Enterprise Translation
≤1.7.4Update to 1.7.5
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
SiteGuard WP Plugin
≤1.8.6Update to 1.8.7
- Medium5.3Unauthenticated Sensitive Information Exposure via Comment Feeds
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3
- Medium5.5Authenticated (Author+) CSS Injection
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3
- Medium4.3Authenticated (Subscriber+) Email Change Confirmation Bypass
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3