VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 34)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,153 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 34)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Copy Anything to Clipboard for WordPress – Copy Button, Copy Text & Copy Code<5.5.5Update to 5.5.5
CVE-2026-110524—
Medium5.3Unauthenticated Information Exposure
Essential Addons for Elementor – Popular Elementor Templates & Widgets<6.8.7Update to 6.8.7
CVE-2026-110509—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Page Builder by SiteOrigin<2.38.0Update to 2.38.0
CVE-2026-110506—
Medium5.33.1.0 - Unauthenticated Insecure Direct Object Reference
PayPlug for WooCommerce (Official)2.9.0 – 3.1.0Update to 3.1.1
CVE-2026-110292—
Medium5.31.7.1069 - Unauthenticated Information Exposure
Royal Addons for Elementor – Addons and Templates Kit for Elementor1.3.81 – 1.7.1069Update to 1.7.1070
CVE-2026-107100—
Medium6.41.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor1.7.1037 – 1.7.1069Update to 1.7.1070
CVE-2026-107098—
Medium5.31.7.1069 - Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor1.3.71 – 1.7.1069Update to 1.7.1070
CVE-2026-107097—
Medium4.31.7.1069 - Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor1.3.68 – 1.7.1069Update to 1.7.1070
CVE-2026-106647—
Medium5.3Missing Authorization
Court Reservation – Tennis, Padel & Sports Court Booking<1.12.4Update to 1.12.4
CVE-2026-106003—
Medium5.3Missing Authorization
Booking Package<1.7.33Update to 1.7.33
CVE-2026-105997—
High7.2Unauthenticated Stored Cross-Site Scripting
Menu Cart for WooCommerce<3.2.1Update to 3.2.1
CVE-2026-105972—
Medium4.9Authenticated (Editor+) SQL Injection
Thrive Automator<11.2Update to 11.2
CVE-2026-104694—
Critical9.8Unauthenticated Arbitrary File Upload
Checkout Files Upload for WooCommerce<2.4.0Update to 2.4.0
CVE-2026-103688—
Medium5.3Unauthenticated Insecure Direct Object Reference
Payconiq≤1.0.4No patch available
CVE-2026-103372—
High8.17.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress≤7.1.3Update to 4.7.39 or 4.8.34 or 4.9.35 or 5.0.31 or 5.1.28 or 5.2.30 or 5.3.27 or 5.4.25 or 5.5.24 or 5.6.23 or 5.7.21 or 5.8.19 or 5.9.20 or 6.0.18 or 6.1.16 or 6.2.15 or 6.3.14 or 6.4.14 or 6.5.14 or 6.6.11 or 6.7.11 or 6.8.12 or 6.9.11 or 7.0.8 or 7.1.4CISA KEVPublic PoC
CVE-2026-119977—
Medium6.1Reflected Cross-Site Scripting via 'new_kb_config' Parameter
Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search≤17.214.0Update to 17.311.0
CVE-2026-101935—
Medium4.3Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
Enable Media Replace≤4.2.2Update to 4.2.3
CVE-2026-85655—
Critical9.8Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
Contact Manager≤9.1.2Update to 9.1.3
CVE-2026-109218—
Medium6.1Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
Webheadcoder Multi-Step Forms for Contact Form 7≤4.7Update to 4.7.1
CVE-2026-92098—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
CMB2≤2.13.4Update to 2.13.5
CVE-2026-116761—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons≤4.7.2Update to 4.7.3
CVE-2026-111111—
Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
Awesome Support – WordPress HelpDesk & Support Plugin≤6.4.1Update to 6.4.2
CVE-2026-103370—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink
Postie≤1.9.87Update to 1.9.88
CVE-2026-100175—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
If-So Dynamic Content – Elementor & All Page Builders Personalization≤1.10.2Update to 1.10.3
CVE-2026-103996—
High8.8Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
VikRentCar Car Rental Management System≤1.4.8Update to 1.4.9
CVE-2026-111120—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action
AI ChatBot for WooCommerce – WoowBot≤5.0.0Update to 5.0.1
CVE-2026-111372—
High8.8Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
The Innovative Form Builder – IvyForms≤1.5.1Update to 1.5.2
CVE-2026-109384—
Medium6.5Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
WP Inventory Manager≤2.5.5Update to 2.5.6
CVE-2026-76005—
Medium6.3Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility≤1.3.6Update to 1.3.7
CVE-2026-76780—
Medium5.3Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
PayPal Brasil para WooCommerce≤1.7.8Update to 1.7.9
CVE-2026-76058—

Search VulnCrest Radar

Jump to

Are you sure?