VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 299)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 299)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Unauthenticated Stored Cross-Site Scripting
WP-WebAuthn≤1.3.4No patch available
CVE-2025-13910—
Low3.8Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field
Post Affiliate Pro≤1.29.0Update to 1.29.1
CVE-2026-2290—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Survey≤1.1No patch available
CVE-2026-1247—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute
Multi Post Carousel by Category≤1.4No patch available
CVE-2026-1275—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields
Mandatory Field≤1.6.8No patch available
CVE-2026-1278—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode
Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase≤4.9.0Update to 5.0.0
CVE-2026-0609—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
FAQ Accordion for WordPress with FAQ Schema & AI Generator – WPFAQBlock≤1.2.1Update to 2.0.0
CVE-2026-1093—
Medium4.3Cross-Site Request Forgery to Settings Update
Add Google Social Profiles to Knowledge Graph Box≤1.0No patch available
CVE-2026-1393—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes
PQ Addons – Creative Elementor Widgets≤1.0.0No patch available
CVE-2026-1397—
Medium4.3Cross-Site Request Forgery to Settings Update
Redirect countdown≤1.0No patch available
CVE-2026-1390—
Medium4.3Cross-Site Request Forgery to Settings Update
WP Posts Re-order≤1.0No patch available
CVE-2026-1378—
Medium4.3Cross-Site Request Forgery to Settings Update
SR WP Minify HTML≤2.1No patch available
CVE-2026-1392—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Schema Shortcode≤1.0No patch available
CVE-2026-1575—
Medium6.1Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Comment Genius≤1.2.5No patch available
CVE-2026-1647—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute
Post Flagger≤1.1No patch available
CVE-2026-1854—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
iVysilani Shortcode≤3.0No patch available
CVE-2026-1851—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WP NG Weather≤1.0.9No patch available
CVE-2026-1822—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Tour & Activity Operator Plugin for TourCMS≤1.7.0No patch available
CVE-2026-1806—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion
Company Posts for LinkedIn≤1.0.0No patch available
CVE-2026-1935—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
Group Chat & Video Chat by AtomChat≤1.1.7Update to 1.1.8
CVE-2026-1253—
High8.3Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content
MimeTypes Link Icons≤3.2.20Update to 3.3.0
CVE-2026-1313—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta
Easy Image Gallery≤1.5.4Update to 1.5.5
CVE-2026-4766—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting
Weaver Show Posts≤1.8.1Update to 2.0
CVE-2026-2121—
Medium6.1Reflected Cross-Site Scripting via 'url' and 'regex' Parameters
rexCrawler≤1.0.15No patch available
CVE-2026-2277—
High7.2Unauthenticated Stored Cross-Site Scripting
SurveyJS: Drag & Drop Form Builder≤2.5.3No patch available
CVE-2026-2440—
High7.2Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters
myLinksDump≤1.6No patch available
CVE-2026-2279—
Medium6.1Reflected Cross-Site Scripting via 'day_from' Parameter
itsukaita≤0.1.2No patch available
CVE-2026-2427—
Medium4.3Cross-Site Request Forgery to Stored Cross-Site Scripting
Plugin Name: login_register≤1.2.0No patch available
CVE-2026-1503—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings
Reward Video Ad for WordPress≤1.6No patch available
CVE-2026-2424—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Review Map by RevuKangaroo≤1.7No patch available
CVE-2026-4161—

Search VulnCrest Radar

Jump to

Are you sure?