VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 284)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 284)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3Unauthenticated Arbitrary User Deletion via 'user_id' Parameter
Riaxe Product Customizer≤2.1.2No patch available
CVE-2026-3595—
Critical9.8Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action
Riaxe Product Customizer≤2.1.2No patch available
CVE-2026-3596—
High8.810.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress9.11.0 – 10.8.1Update to 10.8.2
CVE-2026-3614—
High7.5Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
Payment Gateway for Redsys & WooCommerce Lite≤7.0.0Update to 7.0.1
CVE-2026-5050—
Medium6.1Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode
CodeColorer≤0.10.1Update to 0.10.2
CVE-2026-4032—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content
Vantage≤1.20.32Update to 1.20.33
CVE-2026-5070—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'
WP Docs≤2.2.9Update to 2.3.0
CVE-2026-3878—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
Shortcodes Ultimate – Content Elements≤7.4.9Update to 7.5.0
CVE-2026-3885—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode
WP YouTube Lyte≤1.7.29Update to 1.7.30
CVE-2026-3299—
Critical9.8Unauthenticated Privilege Escalation via Insecure Token Authentication
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)≤1.11.0Update to 1.12.0
CVE-2026-4880—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.16.12Update to 4.16.13
CVE-2026-4949—
Medium4.3Authenticated (Board Member+) Insecure Direct Object Reference
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration≤1.91.2Update to 1.91.3
CVE-2026-40784—
Medium4.3Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery
UserPro - Community and User Profile WordPress Plugin<5.1.11Update to 5.1.11
CVE-2025-53444—
Medium6.5Authenticated (Store vendor+) SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce≤3.7.2Update to 3.7.3
CVE-2025-63029—
Medium4.3Cross-Site Request Forgery
Smart Online Order for Clover≤1.6.4Update to 1.6.5
CVE-2025-15635—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Mini Ajax Cart for WooCommerce≤1.3.4Update to 1.3.5
CVE-2026-6370—
Medium5.3Missing Authorization
Accept Cryptocurrencies with Plisio≤2.0.6No patch available
CVE-2026-6372—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Video Gallery – YouTube Gallery, Playlist & Video Grid≤3.5.1Update to 3.5.2
CVE-2025-15636—
Medium6.1Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion
Product Pricing Table by WooBeWoo≤1.1.0Update to 1.1.1
CVE-2026-1852—
Medium5.3Unauthenticated Payment Amount Manipulation via 'mf-calculation'
MetForm Pro≤3.9.7Update to 3.9.8
CVE-2026-1782—
Critical9.8Unauthenticated Authentication Bypass via Billing Email
Visa Acceptance Solutions≤2.1.0No patch available
CVE-2026-3461—
High7.2Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API
Accessibly – WordPress Website Accessibility≤3.0.3No patch available
CVE-2026-3643—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute
Coachific Shortcode≤1.0No patch available
CVE-2026-4005—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
WP Circliful≤1.2No patch available
CVE-2026-3659—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
WM JqMath≤1.3No patch available
CVE-2026-3998—
Medium6.1Cross-Site Request Forgery
OPEN-BRAIN≤0.5.0No patch available
CVE-2026-4091—
Medium4.3Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action
Petje.af≤2.1.8No patch available
CVE-2026-4002—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action
Katalogportal-pdf-sync Widget≤1.0.0No patch available
CVE-2026-3649—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX
e-shot≤1.0.2No patch available
CVE-2026-3642—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Power Charts – Responsive Beautiful Charts & Graphs≤0.1.0No patch available
CVE-2026-4011—

Search VulnCrest Radar

Jump to

Are you sure?