VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 317)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 317)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_meta Fields
Blocksy≤2.1.30Update to 2.1.31
CVE-2026-2583—
High8.8Authenticated (Subscriber+) Remote Code Execution via render_preview
Master Addons for Elementor Premium≤2.1.3Update to 2.1.4
CVE-2026-3132—
High7.5Unauthenticated SQL Injection
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe≤28.1.4Update to 28.1.5
CVE-2026-3180—
High8.1Unauthenticated Local File Inclusion
Equadio≤1.1.3No patch available
CVE-2026-27988—
Medium5.3Missing Authorization
VW Portfolio≤1.3.3Update to 1.3.4
CVE-2026-32437—
High8.1Unauthenticated Local File Inclusion
Gridiron | American Football & NFL Team WordPress≤1.0.14No patch available
CVE-2026-28012—
High8.1Unauthenticated Local File Inclusion
Maxify≤1.0.16No patch available
CVE-2026-27997—
High8.1Unauthenticated Local File Inclusion
Avventure≤1.1.12No patch available
CVE-2026-27991—
High8.1Unauthenticated Local File Inclusion
Coinpress≤1.0.14No patch available
CVE-2026-28007—
High8.1Unauthenticated Local File Inclusion
N7≤2.16.0No patch available
CVE-2026-28045—
Medium5.3Unauthenticated Information Exposure
The Tribal Plugin≤1.3.4Update to 1.3.5
CVE-2026-39709—
High8.1Unauthenticated Local File Inclusion
Green Thumb | Gardening & Landscaping Services WP≤1.1.12No patch available
CVE-2026-28017—
Critical9.8Unauthenticated Privilege Escalation
LMS Elementor Pro≤1.0.4No patch available
CVE-2026-27983—
Medium5.3Missing Authorization
APRIL - Fashion WooCommerce WordPress Theme≤6.8No patch available
CVE-2026-39714—
High8.1Unauthenticated Local File Inclusion
MoneyFlow≤1.0No patch available
CVE-2026-28028—
Medium5.3Missing Authorization
VW Pet Shop≤1.4.7Update to 1.4.8
CVE-2026-32435—
High8.1Unauthenticated Local File Inclusion
Meals & Wheels≤1.1.12No patch available
CVE-2026-27992—
Medium5.3Unauthenticated Information Exposure
RT-Theme 18 Responsive WordPress Theme≤2.5No patch available
CVE-2026-39711—
High8.1Unauthenticated Local File Inclusion
Invetex≤2.18No patch available
CVE-2026-28031—
Medium6.5Authenticated (Contributor+) SQL Injection
CP Contact Form with PayPal≤1.3.61Update to 1.3.62
CVE-2026-32433—
High8.1Handcraft & Artisan Elementor Template Kit <= 1.2.8 - Unauthenticated Local File Inclusion
Craftis - Handcraft & Artisan Elementor Template Kit≤1.2.8No patch available
CVE-2026-28021—
Medium6.1Reflected Cross-Site Scripting
Listify≤3.2.5No patch available
CVE-2026-28042—
High8.1Unauthenticated Local File Inclusion
Translogic | Logistics & Shipment Transportation≤1.2.11No patch available
CVE-2026-28014—
High8.1Unauthenticated Local File Inclusion
Victo - Ultimate Responsive Magento 2 Theme≤1.4.16No patch available
CVE-2026-28047—
High8.1Unauthenticated Local File Inclusion
The Qlean≤2.12No patch available
CVE-2026-27987—
High8.1Unauthenticated Local File Inclusion
Nuts≤1.10No patch available
CVE-2026-28023—
High8.1Unauthenticated Local File Inclusion
Luxury Wine | Liquor Store & Vineyard WP Theme≤1.1.14No patch available
CVE-2026-28016—
High8.1Unauthenticated Local File Inclusion
Bonbon≤1.6No patch available
CVE-2026-28030—
High8.1Unauthenticated Local File Inclusion
Tuning≤1.3No patch available
CVE-2026-28032—
Medium6.5Unauthenticated Arbitrary Shortcode Execution
tagDiv Composer≤5.4.4Update to 5.4.5
CVE-2026-39712—

Search VulnCrest Radar

Jump to

Are you sure?