VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 224)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 224)
SeverityVulnerabilityCVEInstallsPublished
Critical9.1Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter
WP-BusinessDirectory – Business directory plugin for WordPress≤4.0.1Update to 4.0.2
CVE-2026-6070—
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.3.9.1Update to 4.4.0
CVE-2026-11988—
Medium5.3Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More≤1.10.2Update to 1.10.2.1
CVE-2026-12127—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting
JetWidgets For Elementor≤1.0.21Update to 1.0.22
CVE-2026-11380—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode
Event Organiser≤3.12.9Update to 3.12.10
CVE-2026-2387—
High7.2Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter
Custom Payment Gateways for WooCommerce≤2.1.0Update to 2.2.0
CVE-2026-7517—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter
Taskbuilder – Project Management & Task Management Tool With Kanban Board≤5.0.8Update to 5.0.9
CVE-2026-12110—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter
Taskbuilder – Project Management & Task Management Tool With Kanban Board≤5.0.8Update to 5.0.9
CVE-2026-12090—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode
FV Flowplayer Video Player≤7.5.51.7212Update to 7.5.52.7212
CVE-2026-12135—
High7.2Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤8.4.9Update to 8.5.0
CVE-2026-137315K+
Medium6.1Reflected Cross-Site Scripting via 'place' Parameter
WP Google Review Slider≤18.1Update to 18.2
CVE-2026-13015—
High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint
Visualizer – Tables & Charts Manager with Built-in AI Generator≤4.0.3Update to 4.0.4
CVE-2026-13468—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter
Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.13Update to 2.4.14
CVE-2026-9107—
High7.5Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
Video Gallery – YouTube Gallery, Playlist & Video Grid≤4.0.3Update to 4.0.4
CVE-2026-12923—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
Tutor LMS – eLearning and online course solution≤3.9.13Update to 3.9.14
CVE-2026-13443—
Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor≤3.7.7Update to 3.7.8
CVE-2026-12904—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
GiveWP – Donation Plugin and Fundraising Platform≤4.16.0Update to 4.16.1
CVE-2026-13246—
Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action
JoomSport – for Sports: Team & League, Football, Hockey & more≤5.7.8Update to 5.7.9
CVE-2026-12133—
High7.2Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties
Webmention≤5.8.0Update to 5.8.1
CVE-2026-10513—
High7.5Unauthenticated SQL Injection
bpost-shipping-platform≤3.2.2Update to 3.2.3
CVE-2026-8082—
High7.2Children WordPress <= 5.4 - Unauthenticated Stored Cross-Site Scripting
Kids Zone - Children WordPress Theme≤5.4No patch available
CVE-2025-69156—
High7.2Unauthenticated Stored Cross-Site Scripting
Timetics – Appointment Booking Calendar & Scheduling≤1.0.58Update to 1.0.59
CVE-2026-57674—
High7.2Unauthenticated Stored Cross-Site Scripting
wpDataTables (Premium)≤6.5.1.1Update to 6.5.1.2
CVE-2026-57672—
High7.2Unauthenticated Stored Cross-Site Scripting
SpaLab | Beauty Salon WordPress Theme≤6.7No patch available
CVE-2025-69154—
High7.2Unauthenticated Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization≤4.2.7Update to 4.2.8
CVE-2026-57673200K+
Medium6.5Business Consulting WordPress Theme <= 1.0.5 - Authenticated (Subscriber+) Sensitive Information Exopsure
Corpkit - Business Consulting WordPress Theme≤1.0.5No patch available
CVE-2025-69132—
High7.2Unauthenticated Stored Cross-Site Scripting
CodePeople Post Map for Google Maps≤1.2.5Update to 1.2.6
CVE-2026-57670—
High7.2Unauthenticated Stored Cross-Site Scripting
Artale | Wedding Photography WordPress≤2.2.2No patch available
CVE-2025-69152—
High7.2Unauthenticated Stored Cross-Site Scripting
CRT Addons Builder and Widgets for Elementor≤1.6.6Update to 1.6.7
CVE-2026-11767—
Medium6.1Reflected Cross-Site Scripting
Trendy Travel WordPress≤6.7No patch available
CVE-2025-69153—

Search VulnCrest Radar

Jump to

Are you sure?