Database

WordPress Vulnerability Database (page 3)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

WordPress Vulnerability Database (page 3)
Severity	Vulnerability	CVE	Installs	Published
Medium5.3	Unauthenticated Information Exposure WPZOOM Social Feed Widget & Block≤2.4.1Update to 2.4.2	CVE-2026-125766	—	Nov 11
Medium5.3	Missing Authorization Simply Schedule Appointments≤1.6.13.0Update to 1.6.13.4	CVE-2026-125437	—	Nov 11
Medium4.9	Authenticated (Administrator+) SQL Injection WP Directory Kit<1.6.3Update to 1.6.3	CVE-2026-118420	—	Nov 11
Medium5.3	Missing Authorization Restrict User Access – Ultimate Membership & Content Protection≤2.8.3Update to 2.8.4	CVE-2026-115600	—	Nov 11
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Live Composer – Free WordPress Website Builder<2.1.24Update to 2.1.24	CVE-2026-119531	—	Nov 11
Medium4.3	Cross-Site Request Forgery RestroPress – Online Food Ordering System≤3.4.11Update to 3.5.0	CVE-2026-125784	—	Nov 11
Medium5.3	Missing Authorization Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership≤3.5.0Update to 3.5.1	CVE-2026-125439	—	Nov 11
Medium4.3	4.17.3 - Missing Authorization ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content4.16.13 – 4.17.3Update to 4.17.4	CVE-2026-123661	—	Nov 11
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Addon Elements for Elementor (formerly Elementor Addon Elements)≤1.5Update to 1.5.1	CVE-2026-125743	—	Nov 11
Medium5.3	Missing Authorization Security For WooCommerce≤1.0.16No patch available	CVE-2026-123699	—	Nov 11
Medium5.3	Unauthenticated Information Exposure User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor≤4.0.6Update to 4.0.7	CVE-2026-125777	—	Nov 11
Medium5.3	Unauthenticated Information Exposure WP Directory Kit<1.6.3Update to 1.6.3	CVE-2026-118418	—	Nov 11
Medium5.3	Missing Authorization SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.13.0Update to 2.13.1	CVE-2026-125763	—	Nov 11
Medium6.1	Reflected Cross-Site Scripting Knowledge Building<0.7.3Update to 0.7.3	CVE-2026-121863	—	Nov 11
Medium5.3	Unauthenticated Information Exposure Security For WooCommerce≤1.0.16No patch available	CVE-2026-123705	—	Nov 11
High7.2	Unauthenticated Stored Cross-Site Scripting Knowledge Building<0.7.3Update to 0.7.3	CVE-2026-121862	—	Nov 11
Medium5.3	Missing Authorization Schema & Structured Data for WP & AMP<1.70Update to 1.70	CVE-2026-119034	—	Nov 11
Medium4.3	Missing Authorization RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress≤4.1235Update to 4.1236	CVE-2026-125434	—	Nov 11
Medium4.3	Authenticated (Author+) Insecure Direct Object Reference Smush – Image Optimization, Compression, Lazy Load, WebP & CDN<4.3.6Update to 4.3.6	CVE-2026-118241	—	Nov 11
High8.8	Authenticated (Author+) Arbitrary File Upload Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe<34.0.3Update to 34.0.3	CVE-2026-118041	—	Nov 11
Medium4.3	Cross-Site Request Forgery Appointment Dark≤1.3.4No patch available	CVE-2026-125850	—	Nov 11
Medium5.3	Missing Authorization Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.31Update to 2.4.32	CVE-2026-125448	—	Nov 11
Medium4.3	Cross-Site Request Forgery vdequator≤1.2.7No patch available	CVE-2026-125845	—	Nov 11
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Event Post≤6.1.2Update to 6.1.3	CVE-2026-125781	—	Nov 11
Medium5.3	Missing Authorization Event Tickets and Registration<5.30.3.1Update to 5.30.3.1	CVE-2026-122087	—	Nov 11
Medium4.3	Cross-Site Request Forgery Shk Corporate≤2.4.3No patch available	CVE-2026-125849	—	Nov 11
Medium5.3	Missing Authorization WP Job Portal – AI-Powered Recruitment System for Company or Job Board website≤2.7.2Update to 2.8.0	CVE-2026-121014	—	Nov 11
Medium5.3	Missing Authorization Security For WooCommerce≤1.0.16No patch available	CVE-2026-123703	—	Nov 11
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting GenerateBlocks≤2.5.0Update to 2.5.1	CVE-2026-121773	—	Nov 11
Medium5.3	Unauthenticated Information Exposure Security For WooCommerce≤1.0.16No patch available	CVE-2026-123698	—	Nov 11

Medium5.3
Unauthenticated Information Exposure
WPZOOM Social Feed Widget & Block
≤2.4.1Update to 2.4.2
CVE-2026-125766Nov 11
Medium5.3
Missing Authorization
Simply Schedule Appointments
≤1.6.13.0Update to 1.6.13.4
CVE-2026-125437Nov 11
Medium4.9
Authenticated (Administrator+) SQL Injection
WP Directory Kit
<1.6.3Update to 1.6.3
CVE-2026-118420Nov 11
Medium5.3
Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.3Update to 2.8.4
CVE-2026-115600Nov 11
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Live Composer – Free WordPress Website Builder
<2.1.24Update to 2.1.24
CVE-2026-119531Nov 11
Medium4.3
Cross-Site Request Forgery
RestroPress – Online Food Ordering System
≤3.4.11Update to 3.5.0
CVE-2026-125784Nov 11
Medium5.3
Missing Authorization
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership
≤3.5.0Update to 3.5.1
CVE-2026-125439Nov 11
Medium4.3
4.17.3 - Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
4.16.13 – 4.17.3Update to 4.17.4
CVE-2026-123661Nov 11
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.5Update to 1.5.1
CVE-2026-125743Nov 11
Medium5.3
Missing Authorization
Security For WooCommerce
≤1.0.16No patch available
CVE-2026-123699Nov 11
Medium5.3
Unauthenticated Information Exposure
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.6Update to 4.0.7
CVE-2026-125777Nov 11
Medium5.3
Unauthenticated Information Exposure
WP Directory Kit
<1.6.3Update to 1.6.3
CVE-2026-118418Nov 11
Medium5.3
Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.13.0Update to 2.13.1
CVE-2026-125763Nov 11
Medium6.1
Reflected Cross-Site Scripting
Knowledge Building
<0.7.3Update to 0.7.3
CVE-2026-121863Nov 11
Medium5.3
Unauthenticated Information Exposure
Security For WooCommerce
≤1.0.16No patch available
CVE-2026-123705Nov 11
High7.2
Unauthenticated Stored Cross-Site Scripting
Knowledge Building
<0.7.3Update to 0.7.3
CVE-2026-121862Nov 11
Medium5.3
Missing Authorization
Schema & Structured Data for WP & AMP
<1.70Update to 1.70
CVE-2026-119034Nov 11
Medium4.3
Missing Authorization
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1235Update to 4.1236
CVE-2026-125434Nov 11
Medium4.3
Authenticated (Author+) Insecure Direct Object Reference
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
<4.3.6Update to 4.3.6
CVE-2026-118241Nov 11
High8.8
Authenticated (Author+) Arbitrary File Upload
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
<34.0.3Update to 34.0.3
CVE-2026-118041Nov 11
Medium4.3
Cross-Site Request Forgery
Appointment Dark
≤1.3.4No patch available
CVE-2026-125850Nov 11
Medium5.3
Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.31Update to 2.4.32
CVE-2026-125448Nov 11
Medium4.3
Cross-Site Request Forgery
vdequator
≤1.2.7No patch available
CVE-2026-125845Nov 11
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Event Post
≤6.1.2Update to 6.1.3
CVE-2026-125781Nov 11
Medium5.3
Missing Authorization
Event Tickets and Registration
<5.30.3.1Update to 5.30.3.1
CVE-2026-122087Nov 11
Medium4.3
Cross-Site Request Forgery
Shk Corporate
≤2.4.3No patch available
CVE-2026-125849Nov 11
Medium5.3
Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.2Update to 2.8.0
CVE-2026-121014Nov 11
Medium5.3
Missing Authorization
Security For WooCommerce
≤1.0.16No patch available
CVE-2026-123703Nov 11
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
GenerateBlocks
≤2.5.0Update to 2.5.1
CVE-2026-121773Nov 11
Medium5.3
Unauthenticated Information Exposure
Security For WooCommerce
≤1.0.16No patch available
CVE-2026-123698Nov 11