Database

WordPress Vulnerability Database (page 321)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 321)
Severity	Vulnerability	CVE	Installs	Published
High8.1	Unauthenticated Local File Inclusion Yacht Rental - Boat Services WordPress Theme≤2.6No patch available	CVE-2026-28051	—	Feb 27
Medium5.3	Missing Authorization Guff - Blog & Magazine Ghost Theme≤1.0.1No patch available	CVE-2026-28076	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Marcell - Personal Blog & Magazine WordPress Theme≤1.2.14No patch available	CVE-2026-28095	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Mandala - Responsive Ecommerce WordPress Theme≤2.8No patch available	CVE-2026-28057	—	Feb 27
Medium5.3	Unauthenticated HTTP Header Injection Ajaxify Comments – Ajax and Lazy Loading Comments≤3.1Update to 3.2	CVE-2026-2811	—	Feb 27
Medium6.4	Authenticated (Author+) Server-Side Request Forgery Featured Image from Content – AI Featured Image Generator≤1.6Update to 1.7	CVE-2026-27759	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Daiquiri≤1.2.4No patch available	CVE-2026-28089	—	Feb 27
High8.1	Unauthenticated Local File Inclusion asia-garden≤1.3.1No patch available	CVE-2026-28063	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Legal Stone \| Lawyers & Attorneys WordPress Theme≤1.2.11No patch available	CVE-2026-28054	—	Feb 27
Medium5.3	Missing Authorization The Publisher Desk ads.txt≤1.5.0No patch available	CVE-2026-39698	—	Feb 27
High8.1	Unauthenticated Local File Inclusion gamezone≤1.1.11No patch available	CVE-2026-28090	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Coleo≤1.1.7No patch available	CVE-2026-28091	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Windsor - Apartment Complex Single Property WordPress Theme≤2.5.0No patch available	CVE-2026-28081	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Sounder \| Internet Radio & Streaming Elementor Template Kit≤1.3.11No patch available	CVE-2026-28092	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Save Life \| Non-Profit, Charity & Donations WordPress Theme≤1.2.13No patch available	CVE-2026-28098	—	Feb 27
High8.1	Unauthenticated PHP Object Injection Pizza House - Restaurant / Cafe / Bistro WordPress Theme≤1.4.0No patch available	CVE-2026-28074	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Conquerors \| American Football & NFL PSD Template≤1.2.13No patch available	CVE-2026-28079	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Bazinga \| Viral Blog WordPress Theme≤1.1.9No patch available	CVE-2026-28084	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Aqualots≤1.1.6No patch available	CVE-2026-28088	—	Feb 27
Medium4.3	Missing Authorization Admin and Site Enhancements (ASE)≤8.4.0Update to 8.4.1	CVE-2026-32423	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Vapester \| Cigarette Store & Vape Shop WooCommerce Theme≤1.1.10No patch available	CVE-2026-28077	—	Feb 27
Medium5.3	Missing Authorization AI Workflow Automation≤2.0.3Update to 2.0.4	CVE-2026-39699	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Edge Decor≤2.2No patch available	CVE-2026-28064	—	Feb 27
Medium5.3	Missing Authorization MAIO – ChatGPT SEO Tracking & AI Search Optimization≤7.0.11Update to 7.0.13	CVE-2026-39697	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Mahogany≤2.9No patch available	CVE-2026-28085	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Bassein \| Swimming Pool Cleaning & Maintenance WordPress Theme≤1.0.15No patch available	CVE-2026-28067	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Police Department - Fire & Security WordPress Theme≤2.17No patch available	CVE-2026-28049	—	Feb 27
High8.1	Unauthenticated Local File Inclusion M.Williamson \| Lawyer & Legal Adviser WordPress Theme≤1.2.11No patch available	CVE-2026-28055	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Dixon & Lamber≤1.4.2.1No patch available	CVE-2026-28058	—	Feb 27
High8.1	Unauthenticated Local File Inclusion Beacon \| Funeral Services WordPress Theme≤2.24No patch available	CVE-2026-28050	—	Feb 27

High8.1
Unauthenticated Local File Inclusion
Yacht Rental - Boat Services WordPress Theme
≤2.6No patch available
CVE-2026-28051Feb 27
Medium5.3
Missing Authorization
Guff - Blog & Magazine Ghost Theme
≤1.0.1No patch available
CVE-2026-28076Feb 27
High8.1
Unauthenticated Local File Inclusion
Marcell - Personal Blog & Magazine WordPress Theme
≤1.2.14No patch available
CVE-2026-28095Feb 27
High8.1
Unauthenticated Local File Inclusion
Mandala - Responsive Ecommerce WordPress Theme
≤2.8No patch available
CVE-2026-28057Feb 27
Medium5.3
Unauthenticated HTTP Header Injection
Ajaxify Comments – Ajax and Lazy Loading Comments
≤3.1Update to 3.2
CVE-2026-2811Feb 27
Medium6.4
Authenticated (Author+) Server-Side Request Forgery
Featured Image from Content – AI Featured Image Generator
≤1.6Update to 1.7
CVE-2026-27759Feb 27
High8.1
Unauthenticated Local File Inclusion
Daiquiri
≤1.2.4No patch available
CVE-2026-28089Feb 27
High8.1
Unauthenticated Local File Inclusion
asia-garden
≤1.3.1No patch available
CVE-2026-28063Feb 27
High8.1
Unauthenticated Local File Inclusion
Legal Stone | Lawyers & Attorneys WordPress Theme
≤1.2.11No patch available
CVE-2026-28054Feb 27
Medium5.3
Missing Authorization
The Publisher Desk ads.txt
≤1.5.0No patch available
CVE-2026-39698Feb 27
High8.1
Unauthenticated Local File Inclusion
gamezone
≤1.1.11No patch available
CVE-2026-28090Feb 27
High8.1
Unauthenticated Local File Inclusion
Coleo
≤1.1.7No patch available
CVE-2026-28091Feb 27
High8.1
Unauthenticated Local File Inclusion
Windsor - Apartment Complex Single Property WordPress Theme
≤2.5.0No patch available
CVE-2026-28081Feb 27
High8.1
Unauthenticated Local File Inclusion
Sounder | Internet Radio & Streaming Elementor Template Kit
≤1.3.11No patch available
CVE-2026-28092Feb 27
High8.1
Unauthenticated Local File Inclusion
Save Life | Non-Profit, Charity & Donations WordPress Theme
≤1.2.13No patch available
CVE-2026-28098Feb 27
High8.1
Unauthenticated PHP Object Injection
Pizza House - Restaurant / Cafe / Bistro WordPress Theme
≤1.4.0No patch available
CVE-2026-28074Feb 27
High8.1
Unauthenticated Local File Inclusion
Conquerors | American Football & NFL PSD Template
≤1.2.13No patch available
CVE-2026-28079Feb 27
High8.1
Unauthenticated Local File Inclusion
Bazinga | Viral Blog WordPress Theme
≤1.1.9No patch available
CVE-2026-28084Feb 27
High8.1
Unauthenticated Local File Inclusion
Aqualots
≤1.1.6No patch available
CVE-2026-28088Feb 27
Medium4.3
Missing Authorization
Admin and Site Enhancements (ASE)
≤8.4.0Update to 8.4.1
CVE-2026-32423Feb 27
High8.1
Unauthenticated Local File Inclusion
Vapester | Cigarette Store & Vape Shop WooCommerce Theme
≤1.1.10No patch available
CVE-2026-28077Feb 27
Medium5.3
Missing Authorization
AI Workflow Automation
≤2.0.3Update to 2.0.4
CVE-2026-39699Feb 27
High8.1
Unauthenticated Local File Inclusion
Edge Decor
≤2.2No patch available
CVE-2026-28064Feb 27
Medium5.3
Missing Authorization
MAIO – ChatGPT SEO Tracking & AI Search Optimization
≤7.0.11Update to 7.0.13
CVE-2026-39697Feb 27
High8.1
Unauthenticated Local File Inclusion
Mahogany
≤2.9No patch available
CVE-2026-28085Feb 27
High8.1
Unauthenticated Local File Inclusion
Bassein | Swimming Pool Cleaning & Maintenance WordPress Theme
≤1.0.15No patch available
CVE-2026-28067Feb 27
High8.1
Unauthenticated Local File Inclusion
Police Department - Fire & Security WordPress Theme
≤2.17No patch available
CVE-2026-28049Feb 27
High8.1
Unauthenticated Local File Inclusion
M.Williamson | Lawyer & Legal Adviser WordPress Theme
≤1.2.11No patch available
CVE-2026-28055Feb 27
High8.1
Unauthenticated Local File Inclusion
Dixon & Lamber
≤1.4.2.1No patch available
CVE-2026-28058Feb 27
High8.1
Unauthenticated Local File Inclusion
Beacon | Funeral Services WordPress Theme
≤2.24No patch available
CVE-2026-28050Feb 27