Database

WordPress Vulnerability Database (page 257)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 257)
Severity	Vulnerability	CVE	Installs	Published
Medium4.8	Authenticated (Administrator+) Stored Cross-Site Scripting via Settings rexCrawler≤1.0.15No patch available	CVE-2026-2280	—	May 26
Medium6.1	Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter WP Promoter≤1.3No patch available	CVE-2026-8906	—	May 26
Medium4.3	Cross-Site Request Forgery to Plugin Settings Update via Settings Page MetaMagic SEO Plugin≤1.6No patch available	CVE-2026-8942	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Github Shortcode≤0.1No patch available	CVE-2026-8042	—	May 26
High8.8	Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager≤2.3.5Update to 2.3.6	CVE-2026-8832	—	May 26
Medium6.5	Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade Enable jQuery Migrate Helper≤1.4.1No patch available	CVE-2026-3279	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes WPBakery Page Builder Addons by Livemesh≤3.9.4No patch available	CVE-2026-2030	—	May 26
Medium6.4	Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization Livemesh Addons for Beaver Builder≤3.9.2No patch available	CVE-2026-3897	—	May 26
Medium6.4	Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting Livemesh SiteOrigin Widgets≤3.9.2No patch available	CVE-2026-3896	—	May 26
Medium6.4	Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting WPBakery Page Builder Addons by Livemesh≤3.9.4No patch available	CVE-2026-3895	—	May 26
Medium4.9	Authenticated (Administrator+) SQL Injection via 'orderby' Parameter EnvíaloSimple: Email Marketing y Newsletters≤2.4.5Update to 2.4.6	CVE-2026-7618	—	May 26
High7.2	Authenticated (Editor+) Remote Code Execution affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display≤3.8.4No patch available	CVE-2026-6169	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Shortcode Buddy≤0.1.9.5No patch available	CVE-2026-8897	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes iWR Tooltip≤1.0No patch available	CVE-2026-8894	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes BitForm – Data management solution for WordPress≤1.1.0No patch available	CVE-2026-8891	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Listen Shortcode≤1.0No patch available	CVE-2026-8887	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute hk_shortcode≤1.0No patch available	CVE-2026-8886	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Instant-Quote.co Quotation Page≤1.3.4No patch available	CVE-2026-8884	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Responsive Video Embedder≤0.1No patch available	CVE-2026-8877	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Easy Prism Syntax Highlighter≤1.0.2No patch available	CVE-2026-8875	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Content Slideshow≤2.4.1Update to 2.5	CVE-2026-8873	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Animate Your Content≤1.0.0No patch available	CVE-2026-8872	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Formidable Kinetic≤1.1.01No patch available	CVE-2026-8871	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Team Master – A Modern WordPress Team Showcase≤1.1.2No patch available	CVE-2026-8870	—	May 26
High7.5	Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute Query Shortcode≤0.2.1No patch available	CVE-2026-9200	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute Mutual Funds Data≤1.2.1No patch available	CVE-2026-8869	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Single Mailchimp≤1.4No patch available	CVE-2026-8868	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Post Categories Gallery≤1.0.0No patch available	CVE-2026-8867	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Auto Thumbnails≤1.0No patch available	CVE-2026-8899	—	May 26
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes jQuery googleslides≤1.3No patch available	CVE-2026-8866	—	May 26

Medium4.8
Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
rexCrawler
≤1.0.15No patch available
CVE-2026-2280May 26
Medium6.1
Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter
WP Promoter
≤1.3No patch available
CVE-2026-8906May 26
Medium4.3
Cross-Site Request Forgery to Plugin Settings Update via Settings Page
MetaMagic SEO Plugin
≤1.6No patch available
CVE-2026-8942May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Github Shortcode
≤0.1No patch available
CVE-2026-8042May 26
High8.8
Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
≤2.3.5Update to 2.3.6
CVE-2026-8832May 26
Medium6.5
Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade
Enable jQuery Migrate Helper
≤1.4.1No patch available
CVE-2026-3279May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WPBakery Page Builder Addons by Livemesh
≤3.9.4No patch available
CVE-2026-2030May 26
Medium6.4
Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization
Livemesh Addons for Beaver Builder
≤3.9.2No patch available
CVE-2026-3897May 26
Medium6.4
Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Livemesh SiteOrigin Widgets
≤3.9.2No patch available
CVE-2026-3896May 26
Medium6.4
Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
WPBakery Page Builder Addons by Livemesh
≤3.9.4No patch available
CVE-2026-3895May 26
Medium4.9
Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
EnvíaloSimple: Email Marketing y Newsletters
≤2.4.5Update to 2.4.6
CVE-2026-7618May 26
High7.2
Authenticated (Editor+) Remote Code Execution
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.8.4No patch available
CVE-2026-6169May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Shortcode Buddy
≤0.1.9.5No patch available
CVE-2026-8897May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
iWR Tooltip
≤1.0No patch available
CVE-2026-8894May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
BitForm – Data management solution for WordPress
≤1.1.0No patch available
CVE-2026-8891May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Listen Shortcode
≤1.0No patch available
CVE-2026-8887May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
hk_shortcode
≤1.0No patch available
CVE-2026-8886May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Instant-Quote.co Quotation Page
≤1.3.4No patch available
CVE-2026-8884May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Responsive Video Embedder
≤0.1No patch available
CVE-2026-8877May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Easy Prism Syntax Highlighter
≤1.0.2No patch available
CVE-2026-8875May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Content Slideshow
≤2.4.1Update to 2.5
CVE-2026-8873May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Animate Your Content
≤1.0.0No patch available
CVE-2026-8872May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Formidable Kinetic
≤1.1.01No patch available
CVE-2026-8871May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Team Master – A Modern WordPress Team Showcase
≤1.1.2No patch available
CVE-2026-8870May 26
High7.5
Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
Query Shortcode
≤0.2.1No patch available
CVE-2026-9200May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Mutual Funds Data
≤1.2.1No patch available
CVE-2026-8869May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Single Mailchimp
≤1.4No patch available
CVE-2026-8868May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Post Categories Gallery
≤1.0.0No patch available
CVE-2026-8867May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Auto Thumbnails
≤1.0No patch available
CVE-2026-8899May 26
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
jQuery googleslides
≤1.3No patch available
CVE-2026-8866May 26