VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 187)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 187)
SeverityVulnerabilityCVEInstallsPublished
Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database≤5.2.1Update to 5.2.2
CVE-2026-16614—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Download Manager≤3.3.66Update to 3.3.67
CVE-2026-16685—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox≤2.2.11Update to 2.2.12
CVE-2026-15950—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes
GenerateBlocks≤2.3.0Update to 2.4.0
CVE-2026-13458—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI≤7.9.9.1Update to 7.9.9.2
CVE-2026-16090—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI≤7.9.9.1Update to 7.9.9.2
CVE-2026-16091—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method
Easy Property Listings≤3.5.24Update to 3.5.25
CVE-2026-16684—
Medium5.3Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
Database Collation Fix≤1.2.10Update to 1.2.11
CVE-2026-15018—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints
Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode≤3.9.1Update to 3.9.2
CVE-2026-17580—
High8.8Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini≤3.6.5Update to 3.6.6
CVE-2026-15988—
Medium4.3Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress≤3.1.1Update to 3.1.2
CVE-2026-2916—
Medium4.3Cross-Site Request Forgery to CSS Modification
Theme Editor≤3.1Update to 3.2
CVE-2025-14469—
Critical9.1FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More≤1.9.2Update to 1.10.0
CVE-2026-3141—
Medium4.9Authenticated (Administrator+) SQL Injection via 'field' Parameter
Pinpoint Booking System – Legacy version≤2.9.9.6.9Update to 2.9.9.7.0
CVE-2026-15403—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.8.1Update to 2.8.2
CVE-2026-7623—
High7.5Unauthenticated Arbitrary File Read via Optional CF7 File Field
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation≤2.9.0Update to 2.9.1
CVE-2026-15006—
High8.8Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta
Subscriptions for WooCommerce≤2.0.0Update to 2.0.1
CVE-2026-15414—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta
SendPulse Email Marketing Newsletter≤2.2.5Update to 2.2.6
CVE-2026-13362—
High7.2Unauthenticated Stored Cross-Site Scripting
EONSR AEO Agent≤3.7.9No patch available
CVE-2026-11588—
Medium4.9Authenticated (Editor+) SQL Injection
Welcart e-Commerce≤2.11.31Update to 2.11.32
CVE-2026-16065—
High7.2Unauthenticated Stored Cross-Site Scripting
Meta for WooCommerce≤3.7.5Update to 3.7.6
CVE-2026-66707—
Medium5.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.39Update to 3.7.40
CVE-2026-28145—
Medium4.3Authenticated (Subscriber+) Information Exposure
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings≤4.9.6Update to 4.9.7
CVE-2026-28144—
Medium4.3Authenticated (Author+) Insecure Direct Object Reference
User Profile Picture≤2.6.3Update to 2.6.4
CVE-2026-61971—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute
Powerkit – Supercharge your WordPress Site≤3.1.0Update to 3.1.1
CVE-2026-15645—
Medium5.3Unauthenticated Path Traversal
W3 Total Cache≤2.10.2Update to 2.10.3
CVE-2026-66695—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WPML Multilingual & Multicurrency for WooCommerce≤5.5.6Update to 5.5.7
CVE-2026-66711—
High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform≤4.16.5Update to 4.16.5.1
CVE-2026-66690—
High7.2Unauthenticated Stored Cross-Site Scripting
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings≤1.0.274.1Update to 1.0.275
CVE-2026-66702—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Child Pages Card≤1.8Update to 1.09
CVE-2026-18395—

Search VulnCrest Radar

Jump to

Are you sure?