VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 270)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 270)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form
Skysa Text Ticker App≤1.4No patch available
CVE-2026-6710—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode
Voyage Plus≤1.0.6No patch available
CVE-2026-5715—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter
HEL Online Classroom: AI-powered Online Classrooms≤1.0.3No patch available
CVE-2026-6708—
Medium4.3Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter
Coinbase Business for Contact Form 7≤1.1.2Update to 1.2.0
CVE-2026-6709—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Fancy Image Show≤9.1No patch available
CVE-2026-5340—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Booking Cancellation
Smart Appointment & Booking≤1.0.8Update to 2.0.0
CVE-2026-5693—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode
Bootstrap Shortcode≤1.0No patch available
CVE-2026-7661—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode
Advanced Social Media Icons≤1.2No patch available
CVE-2026-7659—
High7.2Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action
LifePress≤2.2.2No patch available
CVE-2026-6690—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Credits Shortcode & Block≤1.2Update to 1.3
CVE-2026-6256—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
scratchblocks for WP≤1.0.1No patch available
CVE-2026-6247—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Quick Table≤1.0.0No patch available
CVE-2026-6237—
High7.5Unauthenticated SQL Injection
OttoKit: All-in-One Automation Platform<1.1.23Update to 1.1.23
CVE-2026-4935—
Medium5.3Unauthenticated Information Exposure
Online Scheduling and Appointment Booking System – Bookly≤27.4Update to 27.5
CVE-2026-42667—
Medium6.1Reflected Cross-Site Scripting
International Sms For Contact Form 7 Integration≤1.2No patch available
CVE-2022-50960—
Medium6.1Reflected Cross-Site Scripting
Contact Form Builder, Contact Widget≤1.6.1No patch available
CVE-2022-50959—
High7.5Unauthenticated SQL Injection
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress≤1.5.7.3No patch available
CVE-2021-47941—
Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas≤10.30.25Update to 10.30.26
CVE-2026-42666—
Critical9.8Unauthenticated Privilege Escalation
TheCartPress eCommerce Shopping Cart≤1.5.3.6No patch available
CVE-2021-47932—
Medium5.3Missing Authorization
AI Product Search for WooCommerce – Motive Commerce Search≤1.38.2Update to 1.38.3
CVE-2026-42664—
High7.5Unauthenticated SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps≤5.5.70Update to 5.5.71
CVE-2026-42665—
Medium6.5Authenticated (Contributor+) SQL Injection
WP Travel – Ultimate Travel Booking System, Tour Management Engine≤11.4.0Update to 11.5.0
CVE-2026-45218—
Medium5.3Unauthenticated Information Disclosure via REST API
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity≤3.3.6Update to 3.3.7
CVE-2026-8198—
Medium5.3Unauthenticated Account Takeover via Weak Password Recovery Mechanism
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.5.0Update to 5.5.1
CVE-2026-7652—
Medium5.3Broken Authorization
Simple CAPTCHA with Cloudflare Turnstile≤1.38.0Update to 1.38.1
CVE-2026-40799—
Medium6.1Reflected Cross-Site Scripting
avante<3.0.5Update to 3.0.5
CVE-2025-68524—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
NMR Strava activities≤1.0.14Update to 1.0.15
CVE-2026-5341—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Custom Script
Sky Addons for Elementor – 160+ Widgets, GSAP Animations, Templates & Theme Builder≤3.3.2Update to 3.3.3
CVE-2026-7475—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
E2Pdf – Export Pdf Tool for WordPress≤1.32.17Update to 1.32.18
CVE-2026-7650—
High7.2Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Auto Affiliate Links≤6.8.8Update to 6.8.8.1
CVE-2026-7330—

Search VulnCrest Radar

Jump to

Are you sure?