VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 222)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 222)
SeverityVulnerabilityCVEInstallsPublished
High8.1Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
Image Optimizer – Compress Images and Convert to WebP or AVIF≤1.7.4Update to 1.7.5
CVE-2026-5821—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)
Insert Pages≤3.11.4Update to 3.11.5
CVE-2026-10089—
Medium4.3Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress≤5.9.27Update to 5.9.28
CVE-2026-11592—
Medium6.4Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
GiveWP – Donation Plugin and Fundraising Platform≤4.16.1Update to 4.16.2
CVE-2026-13704—
High7.5Unauthenticated Code Injection via 'path' Parameter
Request a Quote – Quote Forms for Any WordPress Site≤2.5.5Update to 2.5.6
CVE-2026-14249—
Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Houzez Property Feed≤2.5.46Update to 2.5.47
CVE-2026-13357—
Critical9.8Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
Blocksy Companion≤2.1.46Update to 2.1.47
CVE-2026-15158—
High7.2Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter
WP Database Backup – Unlimited Database & Files Backup by Backup for WP≤7.11Update to 7.12
CVE-2026-9834—
Medium4.3Missing Authorization
Flatsome≤3.20.5No patch available
CVE-2026-57730—
High7.5Unauthenticated SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤7.3.6Update to 7.3.7
CVE-2026-12987—
Medium4.3Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting
Envo’s Templates & Widgets for Elementor and WooCommerce≤1.4.26Update to 1.4.27
CVE-2026-11600—
Medium4.3Missing Authorization
Link Whisper Premium≤2.9.0Update to 2.9.1
CVE-2026-57353—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetReviews≤3.0.0.1Update to 3.0.0.2
CVE-2026-57354—
Medium4.3Cross-Site Request Forgery
Heateor Social Login WordPress≤1.1.39No patch available
CVE-2026-57751—
Medium4.3Cross-Site Request Forgery
VikBooking Hotel Booking Engine & PMS≤1.8.12Update to 1.8.13
CVE-2026-57723—
High7.2Unauthenticated Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher≤2.8.17Update to 2.8.18
CVE-2026-57349—
Medium4.3Authenticated (Contributor+) Information Exposure
HubSpot All-In-One Marketing – Forms, Popups, Live Chat≤11.3.55Update to 11.3.56
CVE-2026-57736—
Critical9.8Unauthenticated Privilege Escalation
Private Content≤9.9.2Update to 9.10.0
CVE-2026-57692—
Medium6.1Reflected Cross-Site Scripting
SysBasics Customize My Account for WooCommerce – Live My Account Customizer≤4.3.9Update to 4.3.10
CVE-2026-57358—
Medium6.1Reflected Cross-Site Scripting
Search Atlas SEO – OTTO AI SEO Automation for WordPress≤2.6.6Update to 2.6.7
CVE-2026-57357—
High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS≤5.2.2.5Update to 5.2.2.6
CVE-2026-57361—
High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin≤2.3.1Update to 2.3.2
CVE-2026-57366—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcodes and extra features for Phlox theme≤2.17.22Update to 2.17.24
CVE-2026-57737—
High7.2Unauthenticated Stored Cross-Site Scripting
WP Debugging≤2.12.2Update to 2.12.3
CVE-2026-57350—
Critical9.8Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
Divi Form Builder≤5.1.8Update to 5.1.9
CVE-2026-5524—
Medium6.1Unauthenticated Server-Side Request Forgery
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction≤3.0.4Update to 3.0.5
CVE-2026-57348—
Medium4.3Authenticated (Subscriber+) Information Exposure
MotoPress Hotel Booking≤6.0.3Update to 6.0.4
CVE-2026-57347—
Medium4.3Missing Authorization
Flatsome≤3.20.5No patch available
CVE-2026-57731—
Medium4.3Missing Authorization
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More≤6.3.2Update to 6.3.3
CVE-2026-57720—
Medium5.3Missing Authorization
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar≤6.4.13Update to 6.4.14
CVE-2026-27409—

Search VulnCrest Radar

Jump to

Are you sure?