Database

WordPress Vulnerability Database (page 319)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 319)
Severity	Vulnerability	CVE	Installs	Published
High8.1	Unauthenticated Local File Inclusion Tediss \| Play Area & Child Care Center WordPress Theme≤1.2.4No patch available	CVE-2026-27994	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Kayon≤1.3No patch available	CVE-2026-28027	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Edifice≤1.8No patch available	CVE-2026-28033	—	Mar 02
Medium4.3	Missing Authorization Pixfort Core≤3.2.22Update to 3.2.26	CVE-2026-28071	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Stargaze≤1.5No patch available	CVE-2026-28025	—	Mar 02
Medium5.3	Missing Authorization WP Food ordering and Restaurant Menu<2.7.1Update to 2.7.1	CVE-2026-32440	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Yungen≤1.0.12No patch available	CVE-2026-28006	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Printy≤1.8No patch available	CVE-2026-28035	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Chroma≤1.11No patch available	CVE-2026-28020	—	Mar 02
High8.1	Creative Portfolio Template Kit <= 1.0.10 - Unauthenticated Local File Inclusion Quanzo - Creative Portfolio Template Kit≤1.0.10No patch available	CVE-2026-27989	—	Mar 02
Medium5.3	Missing Authorization GiveWP – Donation Plugin and Fundraising Platform≤4.14.5Update to 4.14.6	CVE-2026-42642	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Lingvico \| Language Center & Training Courses WordPress Theme≤1.0.14No patch available	CVE-2026-27996	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Humanum≤1.1.4No patch available	CVE-2026-27985	—	Mar 02
High8.1	Unauthenticated Local File Inclusion progress≤1.2No patch available	CVE-2026-28034	—	Mar 02
Medium5.3	Missing Authorization BigHearts - Charity & Donation WordPress Theme≤3.1.14Update to 3.1.15	CVE-2026-32439	—	Mar 02
Medium6.1	Reflected Cross-Site Scripting Pixfort Core≤3.2.22Update to 3.2.26	CVE-2026-28072	—	Mar 02
Medium5.3	Missing Authorization VW School Education≤1.4.6Update to 1.4.7	CVE-2026-32438	—	Mar 02
High8.1	Unauthenticated Local File Inclusion Manoir≤1.11No patch available	CVE-2026-28019	—	Mar 02
High8.1	Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated Local File Inclusion ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme≤3.0.14No patch available	CVE-2026-28015	—	Mar 02
Medium5.3	Missing Authorization ShopWP≤5.2.4No patch available	CVE-2026-39701	—	Mar 01
Medium5.3	Missing Authorization Make My Trivia≤1.1.0No patch available	CVE-2026-39706	—	Mar 01
Medium5.3	Missing Authorization Popup Like box – Page Plugin≤3.7.7Update to 3.7.8	CVE-2026-32428	—	Mar 01
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates≤2.6.2No patch available	CVE-2026-39702	—	Mar 01
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting WPBITS Addons For Elementor Page Builder≤1.8.1No patch available	CVE-2026-39703	—	Mar 01
Medium5.3	Missing Authorization Precious Metals Product Prices for WooCommerce≤4.1.2Update to 4.1.3	CVE-2026-39704	—	Mar 01
Medium4.3	Missing Authorization 3D Viewer – Turn Product Pages into Interactive 3D Experiences≤1.8.5Update to 1.8.6	CVE-2026-40729	—	Mar 01
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting PowerPack Addons for Elementor: Widgets, Form Styler and Templates≤2.9.9Update to 2.9.10	CVE-2026-32430	—	Mar 01
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )≤1.4.1Update to 1.4.2	CVE-2026-32429	—	Mar 01
Medium5.3	Missing Authorization WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation≤1.4.37Update to 1.4.38	CVE-2026-39700	—	Mar 01
Medium5.3	Missing Authorization VW Education Lite≤2.2.0Update to 2.2.1	CVE-2026-32427	—	Mar 01

High8.1
Unauthenticated Local File Inclusion
Tediss | Play Area & Child Care Center WordPress Theme
≤1.2.4No patch available
CVE-2026-27994Mar 02
High8.1
Unauthenticated Local File Inclusion
Kayon
≤1.3No patch available
CVE-2026-28027Mar 02
High8.1
Unauthenticated Local File Inclusion
Edifice
≤1.8No patch available
CVE-2026-28033Mar 02
Medium4.3
Missing Authorization
Pixfort Core
≤3.2.22Update to 3.2.26
CVE-2026-28071Mar 02
High8.1
Unauthenticated Local File Inclusion
Stargaze
≤1.5No patch available
CVE-2026-28025Mar 02
Medium5.3
Missing Authorization
WP Food ordering and Restaurant Menu
<2.7.1Update to 2.7.1
CVE-2026-32440Mar 02
High8.1
Unauthenticated Local File Inclusion
Yungen
≤1.0.12No patch available
CVE-2026-28006Mar 02
High8.1
Unauthenticated Local File Inclusion
Printy
≤1.8No patch available
CVE-2026-28035Mar 02
High8.1
Unauthenticated Local File Inclusion
Chroma
≤1.11No patch available
CVE-2026-28020Mar 02
High8.1
Creative Portfolio Template Kit <= 1.0.10 - Unauthenticated Local File Inclusion
Quanzo - Creative Portfolio Template Kit
≤1.0.10No patch available
CVE-2026-27989Mar 02
Medium5.3
Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
≤4.14.5Update to 4.14.6
CVE-2026-42642Mar 02
High8.1
Unauthenticated Local File Inclusion
Lingvico | Language Center & Training Courses WordPress Theme
≤1.0.14No patch available
CVE-2026-27996Mar 02
High8.1
Unauthenticated Local File Inclusion
Humanum
≤1.1.4No patch available
CVE-2026-27985Mar 02
High8.1
Unauthenticated Local File Inclusion
progress
≤1.2No patch available
CVE-2026-28034Mar 02
Medium5.3
Missing Authorization
BigHearts - Charity & Donation WordPress Theme
≤3.1.14Update to 3.1.15
CVE-2026-32439Mar 02
Medium6.1
Reflected Cross-Site Scripting
Pixfort Core
≤3.2.22Update to 3.2.26
CVE-2026-28072Mar 02
Medium5.3
Missing Authorization
VW School Education
≤1.4.6Update to 1.4.7
CVE-2026-32438Mar 02
High8.1
Unauthenticated Local File Inclusion
Manoir
≤1.11No patch available
CVE-2026-28019Mar 02
High8.1
Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated Local File Inclusion
ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme
≤3.0.14No patch available
CVE-2026-28015Mar 02
Medium5.3
Missing Authorization
ShopWP
≤5.2.4No patch available
CVE-2026-39701Mar 01
Medium5.3
Missing Authorization
Make My Trivia
≤1.1.0No patch available
CVE-2026-39706Mar 01
Medium5.3
Missing Authorization
Popup Like box – Page Plugin
≤3.7.7Update to 3.7.8
CVE-2026-32428Mar 01
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates
≤2.6.2No patch available
CVE-2026-39702Mar 01
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
WPBITS Addons For Elementor Page Builder
≤1.8.1No patch available
CVE-2026-39703Mar 01
Medium5.3
Missing Authorization
Precious Metals Product Prices for WooCommerce
≤4.1.2Update to 4.1.3
CVE-2026-39704Mar 01
Medium4.3
Missing Authorization
3D Viewer – Turn Product Pages into Interactive 3D Experiences
≤1.8.5Update to 1.8.6
CVE-2026-40729Mar 01
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.9.9Update to 2.9.10
CVE-2026-32430Mar 01
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
≤1.4.1Update to 1.4.2
CVE-2026-32429Mar 01
Medium5.3
Missing Authorization
WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation
≤1.4.37Update to 1.4.38
CVE-2026-39700Mar 01
Medium5.3
Missing Authorization
VW Education Lite
≤2.2.0Update to 2.2.1
CVE-2026-32427Mar 01