VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 289)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 289)
SeverityVulnerabilityCVEInstallsPublished
Critical9.8Unauthenticated Privilege Escalation
WP BASE Booking of Appointments, Services and Events≤5.9.0Update to 6.0.0
CVE-2026-39587—
Medium5.3Unauthenticated Price Manipulation via 'tips'
Online Scheduling and Appointment Booking System – Bookly≤27.0Update to 27.1
CVE-2026-2519—
Medium5.3Unauthenticated Information Exposure
WP Easy Pay – Payment and Donation Form Builder for Square≤4.3.0Update to 4.4.0
CVE-2026-45215—
High8.1Candle Shop WordPress Theme <= 1.3.1 - Unauthenticated PHP Object Injection
Askka - Candle Shop WordPress Theme≤1.3.1Update to 1.4
CVE-2026-39555—
Medium6.5Authenticated (Subscriber+) SQL Injection via membership_ids[]
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.1.2Update to 5.1.3
CVE-2026-1865—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'
Beaver Builder Page Builder – Drag and Drop Website Builder≤2.10.1.1Update to 2.10.1.2
CVE-2026-2481—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
PrivateContent Free≤1.2.0Update to 1.3.0
CVE-2026-4025—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting
Robo Gallery – Photo & Image Slider≤5.1.3Update to 5.1.4
CVE-2026-4300—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute
pdfl.io≤1.0.5Update to 1.0.6
CVE-2026-4073—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute
WP Visitor Statistics (Real Time Traffic)≤8.4Update to 8.5
CVE-2026-4303—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Magic Conversation For Gravity Forms≤3.0.97Update to 3.0.98
CVE-2026-1396—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons≤8.4.2Update to 8.5.0
CVE-2026-4655—
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter
Blog2Social: Social Media Auto Post & Scheduler≤8.8.3Update to 8.8.4
CVE-2026-4330—
Medium5.3Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates≤2.1.7Update to 2.1.8
CVE-2026-5167—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter
Whole Enquiry Cart for WooCommerce≤1.2.1No patch available
CVE-2026-2838—
Critical9.8Unauthenticated Arbitrary File Upload via 'fonturl' Parameter
DSGVO Google Web Fonts GDPR≤1.1No patch available
CVE-2026-3535—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter
WP Blockade – Visual Page Builder≤0.9.14No patch available
CVE-2026-3480—
Medium5.3Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter
PZ Frontend Manager≤1.0.6No patch available
CVE-2026-3477—
Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
AM LottiePlayer≤3.6.3Update to 3.7.0
CVE-2025-1794—
Medium5.4Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter
Attendance Manager≤0.6.2No patch available
CVE-2026-3781—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute
Sports Club Management≤1.12.9No patch available
CVE-2026-4871—
High7.2Authenticated (Administrator+) Arbitrary File Upload
Gerador de Certificados – DevApps≤1.3.6No patch available
CVE-2026-4808—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute
Columns by BestWebSoft – Additional Columns Plugin for Posts Pages and Widgets≤1.0.3No patch available
CVE-2026-3618—
Medium4.3Cross-Site Request Forgery to Playlist Settings Form
Quran Translations≤1.7No patch available
CVE-2026-4141—
Medium5.3Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint
Riaxe Product Customizer≤2.4No patch available
CVE-2026-3594—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_var'
Pinterest Site Verification plugin using Meta Tag≤1.8No patch available
CVE-2026-3142—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Wavr≤0.2.6No patch available
CVE-2026-5506—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WowPress≤1.0.0No patch available
CVE-2026-5508—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Form Header Field
Inquiry form to posts or pages≤1.0No patch available
CVE-2026-5169—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates≤6.4.9Update to 6.4.10
CVE-2026-3311—

Search VulnCrest Radar

Jump to

Are you sure?