VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 269)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 269)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3Unauthenticated Insecure Direct Object Reference
Checkout Files Upload for WooCommerce≤2.2.5Update to 2.2.6
CVE-2026-42725—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Integration API Key Update
Hostinger Reach – AI-Powered Email Marketing for WordPress≤1.3.8Update to 1.3.9
CVE-2026-2515—
Critical9.8Unauthenticated Remote Code Execution
Custom css-js-php≤2.0.7No patch available
CVE-2026-6433—
Medium5.3Missing Authorization
Payment Gateway of Stripe for WooCommerce≤5.0.7Update to 5.0.8
CVE-2026-45217—
Medium5.3Missing Authorization
Hustle – Email Marketing, Lead Generation, Optins, Popups≤7.8.10.1Update to 7.8.10.2
CVE-2026-25431—
Medium5.3Missing Authorization
EventPrime – Events Calendar, Bookings, Tickets & AI≤4.3.2.0Update to 4.3.2.1
CVE-2026-42669—
Medium5.5Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute
WPC Badge Management for WooCommerce≤3.1.6Update to 3.1.7
CVE-2025-14767—
High7.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining
ProfileGrid – User Profiles, Groups and Communities≤5.9.8.4Update to 5.9.8.5
CVE-2026-4609—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder≤6.2.1Update to 6.2.2
CVE-2026-6828—
High7.2Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text
Custom Twitter Feeds – A Tweets Widget or X Feed Widget≤2.5.4Update to 2.5.5
CVE-2026-6177—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' Parameter
Continually≤4.3.1No patch available
CVE-2026-6813—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
FastBots≤1.0.12Update to 1.0.13
CVE-2026-6800—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
Motors – Car Dealership & Classified Listings Plugin≤1.4.103Update to 1.4.104
CVE-2026-1934—
Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via '_kcseo_ative_tab' Parameter
WP SEO Structured Data Schema≤2.8.1No patch available
CVE-2026-3604—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block
BJ Lazy Load≤1.0.9No patch available
CVE-2026-2300—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter
Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings≤1.6.4Update to 1.6.5
CVE-2026-4301—
High7.5Unauthenticated SQL Injection in getListForTbl()
AI Copilot – Content Generator≤1.5.6Update to 1.5.8
CVE-2026-2993—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
Next Date≤1.0No patch available
CVE-2026-4920—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute
SP Blog Designer≤1.0.0No patch available
CVE-2026-4859—
Medium4.3Cross-Site Request Forgery via Settings Update Form
Woo Commerce Minimum Weight≤3.0.1No patch available
CVE-2026-6932—
Medium4.8Unauthenticated Limited Code Execution via update_agent
GWD Conex≤2.9No patch available
CVE-2026-6663—
Medium6.1Reflected Cross-Site Scripting via 'page' Parameter
WP Google Maps Integration≤1.2No patch available
CVE-2026-7464—
Medium6.1Reflected Cross-Site Scripting
AzonPost≤1.3No patch available
CVE-2026-7437—
Medium5.3Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields
Slek Gateway for WooCommerce≤1.0No patch available
CVE-2026-7626—
Medium4.3Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter
Zawgyi Embed≤2.1.1No patch available
CVE-2026-7616—
Medium6.1Reflected Cross-Site Scripting via 'page' Parameter
Pricing Tables for WP≤1.1.0No patch available
CVE-2026-6808—
Medium4.3Cross-Site Request Forgery to Settings Update
WP-Redirection≤1.0.3No patch available
CVE-2026-7562—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Tm – WordPress Redirection≤1.2No patch available
CVE-2026-7561—
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter
Forms RB – Contact Form Builder & Custom Forms≤1.1.9No patch available
CVE-2026-7050—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute
Shortcodely≤1.0.1No patch available
CVE-2026-6913—

Search VulnCrest Radar

Jump to

Are you sure?