VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 30)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software
Active filters:Clear all

41,241 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 30)
SeverityVulnerabilityCVEInstallsPublished
Medium4.97.1.3 - Authenticated (Custom+) Stored Cross-Site Scripting via Externally-Supplied User Login Values
WordPress≤7.1.3Update to 4.7.39 or 4.8.34 or 4.9.35 or 5.0.31 or 5.1.28 or 5.2.30 or 5.3.27 or 5.4.25 or 5.5.24 or 5.6.23 or 5.7.21 or 5.8.19 or 5.9.20 or 6.0.18 or 6.1.16 or 6.2.15 or 6.3.14 or 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Customizer Selective Refresh
WordPress≤7.1.3Update to 5.0.31 or 5.1.28 or 5.2.30 or 5.3.27 or 5.4.25 or 5.5.24 or 5.6.23 or 5.7.21 or 5.8.19 or 5.9.20 or 6.0.18 or 6.1.16 or 6.2.15 or 6.3.14 or 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via Interactivity Router Uploaded Text Files
WordPress≤7.1.3Update to 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Non-HTML Whitespace in Block Delimiters
WordPress≤7.1.3Update to 5.0.31 or 5.1.28 or 5.2.30 or 5.3.27 or 5.4.25 or 5.5.24 or 5.6.23 or 5.7.21 or 5.8.19 or 5.9.20 or 6.0.18 or 6.1.16 or 6.2.15 or 6.3.14 or 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium5.37.1.3 - Unauthenticated Sensitive Information Exposure via Customizer Changesets
WordPress≤7.1.3Update to 4.9.35 or 5.0.31 or 5.1.28 or 5.2.30 or 5.3.27 or 5.4.25 or 5.5.24 or 5.6.23 or 5.7.21 or 5.8.19 or 5.9.20 or 6.0.18 or 6.1.16 or 6.2.15 or 6.3.14 or 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Prototype Pollution
WordPress≤7.1.3Update to 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Event Handler Bindings
WordPress≤7.1.3Update to 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API URL Bindings
WordPress≤7.1.3Update to 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Block Labels
WordPress≤7.1.3Update to 5.9.20 or 6.0.18 or 6.1.16 or 6.2.15 or 6.3.14 or 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Low3.57.1.3 - Authenticated (Contributor+) Stored Denial of Service via Malformed Interactivity API Bindings
WordPress≤7.1.3Update to 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity Script Module Data Shadowing
WordPress≤7.1.3Update to 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image and Playlist Blocks
WordPress≤7.1.3Update to 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium4.47.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Personal Data Erasure Request Email Addresses
WordPress≤7.1.3Update to 4.9.35 or 5.0.31 or 5.1.28 or 5.2.30 or 5.3.27 or 5.4.25 or 5.5.24 or 5.6.23 or 5.7.21 or 5.8.19 or 5.9.20 or 6.0.18 or 6.1.16 or 6.2.15 or 6.3.14 or 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Categories Block
WordPress≤7.1.3Update to 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Low3.87.1.3 - Authenticated (Custom+) Incorrect Authorization to Read, Modify, and Delete Notes via REST API
WordPress≤7.1.3Update to 6.9.11 or 7.0.8 or 7.1.4
——
Medium6.47.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Unsafe Interactivity API Binding Properties
WordPress≤7.1.3Update to 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Low3.57.1.3 - Authenticated (Contributor+) Clickjacking via Interactivity API Object Bindings
WordPress≤7.1.3Update to 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4
——
Medium5.3Missing Authorization
Payable Payment Gateway for WooCommerce≤1.3.0Update to 1.3.1
CVE-2026-94361—
Medium5.39.18 - Unauthenticated Information Exposure
Quick Event Manager8.4.6 – 9.18Update to 9.19
CVE-2026-82214—
Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-80069—
Medium4.3Authenticated (Custom+) Path Traversal
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-80067—
Medium5.3Unauthenticated Arbitrary Content Injection
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content≤0.8.8Update to 0.8.9
CVE-2026-48202—
Low3.5Authenticated (Subscriber+) Arbitrary Page Content Injection
Kirki – Freeform Page Builder, Website Builder & Customizer≤6.4.0Update to 6.4.1
CVE-2026-42694—
Medium6.5Unauthenticated Arbitrary Shortcode Execution
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.3.0Update to 5.3.1
CVE-2026-25467—
Medium5.3Missing Authorization to Unauthenticated Information Exposure
Bricks Theme≤2.4.0Update to 2.4.1
CVE-2026-119325—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO<4.2.5No patch available
CVE-2026-119054—
Medium6.42.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery
Product Import Export for WooCommerce – CSV Product Importer & Exporter2.5.1 – <2.6.8Update to 2.6.8
CVE-2026-118989—
Medium5.3Missing Authorization
Mapster WP Maps≤2.0.5Update to 2.0.6
CVE-2026-118638—
Medium5.3Unauthenticated Information Exposure
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos≤4.0.0Update to 5.0.0
CVE-2026-118629—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Firelight Lightbox≤2.3.23Update to 2.3.24
CVE-2026-118438—

Search VulnCrest Radar

Jump to

Are you sure?