VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 215)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 215)
SeverityVulnerabilityCVEInstallsPublished
High7.2Unauthenticated Stored Cross-Site Scripting
Hydra Booking — Appointment Scheduling & Booking Calendar≤1.1.44Update to 1.1.45
CVE-2026-57388—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
Customer Reviews for WooCommerce≤5.113.0Update to 5.114.0
CVE-2026-13771—
Medium6.1Reflected Cross-Site Scripting
CRM Perks Forms – WordPress Form Builder≤1.1.7Update to 1.1.8
CVE-2026-57421—
Critical9.8Unauthenticated Remote Code Execution
Streamit≤4.5.0No patch available
CVE-2026-13423—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder≤4.7.4Update to 4.7.5
CVE-2026-6740—
Medium5.3Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.1Update to 4.3.2
CVE-2026-5459—
High7.2Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field
VikBooking Hotel Booking Engine & PMS≤1.8.8Update to 1.8.9
CVE-2026-6820—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup
Essential Addons for Elementor – Popular Elementor Templates & Widgets≤6.6.2Update to 6.6.3
CVE-2026-6459—
High7.5Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.4.0Update to 5.4.1
CVE-2026-5356—
High8.1WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace≤2.11.10Update to 2.11.11
CVE-2026-3688—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute
Advanced iFrame≤2026.1Update to 2026.2
CVE-2026-6742—
High7.5Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
My Calendar – Accessible Event Manager≤3.7.8Update to 3.7.9
CVE-2026-6854—
High7.5Unauthenticated SQL Injection via 'geoquery' REST API Parameter
Tainacan≤1.0.3Update to 1.1.0
CVE-2026-6230—
High7.2Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter
VikBooking Hotel Booking Engine & PMS≤1.8.8Update to 1.8.9
CVE-2026-6818—
Medium6.4Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode≤6.20.2Update to 6.20.3
CVE-2025-14785—
Medium4.9Authenticated (Shop Manager+) SQL Injection via 'data' Parameter
Recurio – Ultimate Subscription for WooCommerce≤1.1.3Update to 1.1.4
CVE-2026-12936—
Medium6.3Unauthenticated Privilege Escalation via 'role' Parameter
TH Login Registration≤1.0.2Update to 1.0.3
CVE-2026-14250—
Medium6.1Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
Social Share, Social Login and Social Comments Plugin – Super Socializer≤7.14.5No patch available
CVE-2026-11798—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting
Chatra Live Chat + ChatBot + Cart Saver≤1.0.12Update to 1.0.13
CVE-2026-12041—
High8.8Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token
DoLogin Security≤4.3Update to 4.4
CVE-2026-14495—
High8.8Unauthenticated Arbitrary File Upload via 'ccce' Parameter
WHMCS Bridge≤6.9No patch available
CVE-2026-14489—
Critical9.8Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action
WP Learn Manager≤1.1.8No patch available
CVE-2026-12153—
Medium5.3Missing Authorization to Unauthenticated Plugin Settings Modification
User Management≤1.2Update to 1.3
CVE-2026-12097—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values
Sympl Repeater for ACF and Elementor≤2.3No patch available
CVE-2026-10570—
Medium4.3Cross-Site Request Forgery to Plugin Settings Update
Wp Js Detect≤1.0.9No patch available
CVE-2026-9731—
Medium5.3Unauthenticated Arbitrary File Read via 'csv_url' Parameter
Bulk Order Update for WooCommerce≤1.6No patch available
CVE-2026-14500—
High7.5Unauthenticated SQL Injection via 'code' Parameter
Eventer≤4.4.3Update to 4.4.4
CVE-2026-9700—
Critical9.8Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
Eventer≤4.4.4Update to 4.4.5
CVE-2026-9701—
High7.5Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities
Backstage – Customizer Demo Access≤1.4.2No patch available
CVE-2026-9842—
Critical9.1Unauthenticated Arbitrary File Deletion via 'id' Parameter
Simple Coherent Form≤2.4.13No patch available
CVE-2026-14487—

Search VulnCrest Radar

Jump to

Are you sure?