VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 258)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 258)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Events In City≤3.0No patch available
CVE-2026-8898—
Medium6.1Reflected Cross-Site Scripting via PHP_SELF
NS Product icon badge≤1.2.4No patch available
CVE-2026-8707—
High8.1Authentication Bypass via 'account' Parameter
Login with NEAR≤0.3.3No patch available
CVE-2026-8994—
Medium4.3Cross-Site Request Forgery via gostats_manage() Function
GoStats for WordPress≤1.4No patch available
CVE-2026-8943—
Medium4.3Cross-Site Request Forgery to Plugin Settings Update
CDN Linker lite≤1.3.1No patch available
CVE-2026-8941—
Medium4.3Cross-Site Request Forgery to Plugin Settings Update
Search Simple Fields≤0.2No patch available
CVE-2026-8939—
Medium4.3Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass
auto making JSON-LD≤4.5.3No patch available
CVE-2026-8938—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter
WP AutoBuzz≤1.1.1No patch available
CVE-2026-8911—
Medium5.3Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action
WP Promoter≤1.3No patch available
CVE-2026-9014—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute
WP Iframe Geo Style for Amazon affiliates≤1.1No patch available
CVE-2026-8837—
Medium4.3Cross-Site Request Forgery to Settings Update
Two-factor authentication (formerly IP Vault)≤2.1No patch available
CVE-2026-8903—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Dideo≤1.0No patch available
CVE-2026-8847—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Tuxquote≤1.3No patch available
CVE-2026-8846—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Islamic Database≤1.0No patch available
CVE-2026-8845—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Responsive Check≤0.0.3No patch available
CVE-2026-8844—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Google+ Link Name≤1.0No patch available
CVE-2026-8842—
Medium6.4[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
Endless Scroll≤1.0.0No patch available
CVE-2026-8703—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute
GBI To Print≤1.0No patch available
CVE-2026-8702—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
GNTT Post Title Ticker≤1.0No patch available
CVE-2026-8701—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Cryptocurrency Prijsvergelijking Widget≤1.0No patch available
CVE-2026-8698—
Medium4.3Cross-Site Request Forgery to Settings Update via Plugin Settings Page
Genzel breadcrumbs≤1.2No patch available
CVE-2026-8708—
Medium4.3Cross-Site Request Forgery to Settings Update
Old Posts Highlighter≤1.0.3No patch available
CVE-2026-7614—
High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Admin Chat Management≤3.1.1Update to 3.1.2
CVE-2026-8787—
Critical9.8Unauthenticated Authentication Bypass via OTP Brute Force
Login with OTP≤1.6Update to 1.7
CVE-2026-8760—
Medium6.4[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
My Email Shortcode≤0.91No patch available
CVE-2026-8048—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
faq shortocde≤1.0No patch available
CVE-2026-8040—
Medium5.4WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin≤3.3.8Update to 3.3.9
CVE-2026-6287—
Medium4.3Cross-Site Request Forgery to Campaign Deletion via Campaign Management
CM Ad Changer – A simple tool to control and optimize your site’s banners≤2.0.7Update to 2.0.8
CVE-2026-9236—
Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter
Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤26.5Update to 26.6
CVE-2025-14481—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates≤2.6.3Update to 2.6.4
CVE-2026-15299—

Search VulnCrest Radar

Jump to

Are you sure?