VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 300)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 300)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Ed's Font Awesome≤3.0Update to 3.0.1
CVE-2026-2496—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Ed's Social Share≤3.0Update to 3.0.1
CVE-2026-2501—
Medium6.5Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter
ElementCamp≤2.3.6Update to 2.3.8
CVE-2026-2503—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure
HR Press Lite≤1.0.2Update to 1.0.3
CVE-2026-2720—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
Post Snippits≤1.0No patch available
CVE-2026-2723—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings
Ricerca – advanced search≤1.1.12No patch available
CVE-2026-2837—
High7.5Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter
Fonts Manager | Custom Fonts≤1.2No patch available
CVE-2026-1800—
High8.8Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter
CMS Commander – Manage Multiple Sites≤2.288No patch available
CVE-2026-3334—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MinhNhut Link Gateway≤3.6.1No patch available
CVE-2026-3333—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting
Comment SPAM Wiper≤1.2.1No patch available
CVE-2026-3353—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting
Wikilookup≤1.1.5No patch available
CVE-2026-3354—
Medium5.3Missing Authorization to Unauthenticated File Upload
Canto≤3.1.1Update to 3.1.2
CVE-2026-3335—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter
Multi Functional Flexi Lightbox≤1.2No patch available
CVE-2026-3347—
Medium4.3My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update
Xhanch – My Advanced Settings≤1.1.2No patch available
CVE-2026-3332—
Medium4.3Cross-Site Request Forgery to Settings Update
Lobot Slider Administrator≤0.6.0No patch available
CVE-2026-3331—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute
Any Post Slider≤1.0.4Update to 1.0.5
CVE-2026-1899—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute
FuseDesk≤6.8Update to 6.8.1
CVE-2026-1914—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute
Go Night Pro | WordPress Dark Mode Plugin≤1.1.0No patch available
CVE-2026-1886—
Medium5.3Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint
Appmax≤1.0.3No patch available
CVE-2026-3641—
Medium5.3Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action
Build App Online≤1.0.23No patch available
CVE-2026-3651—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
UiPress lite | Effortless custom dashboards, admin themes and pages≤3.5.09No patch available
CVE-2026-2294—
Medium5.3Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter
REST API TO MiniProgram≤5.1.2No patch available
CVE-2026-3460—
High7.2Unauthenticated Server-Side Request Forgery via 'url' Parameter
Performance Monitor≤1.0.6No patch available
CVE-2026-1648—
High7.2Unauthenticated Server-Side Request Forgery via 'url' Parameter
Content Syndication Toolkit≤1.3No patch available
CVE-2026-3478—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Sherk Custom Post Type Displays≤1.2.1No patch available
CVE-2026-3554—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action
e-shot≤1.0.2No patch available
CVE-2026-3546—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action
Punnel – Landing Page Builder≤1.3.1No patch available
CVE-2026-3645—
Medium5.3Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter
Smarter Analytics≤2.0No patch available
CVE-2026-3570—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Integration with Hubspot Forms≤1.2.2No patch available
CVE-2026-1908—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Simple Football Scoreboard≤1.0No patch available
CVE-2026-1891—

Search VulnCrest Radar

Jump to

Are you sure?