VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 342)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 342)
SeverityVulnerabilityCVEInstallsPublished
High8.1Unauthenticated Local File Inclusion
Splendour≤1.23No patch available
CVE-2025-69396—
Medium4.3Missing Authorization
PDF for Elementor Forms + Drag And Drop Template Builder≤6.3.1Update to 6.5.0
CVE-2026-22350—
Medium4.3Cross-Site Request Forgery
NewsExo≤7.1No patch available
CVE-2026-39618—
Medium5.3Missing Authorization
Restaurant and Cafe≤1.2.5Update to 1.2.6
CVE-2026-32347—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Update
OpenPix for WooCommerce≤2.13.3No patch available
CVE-2025-15400—
High7.5Unauthenticated SQL Injection
Download Manager Addons for Elementor≤1.3.0Update to 2.0.0
CVE-2026-24956—
Medium4.3Cross-Site Request Forgery
Busiprof≤2.5.2No patch available
CVE-2026-39619—
Medium4.3Cross-Site Request Forgery
Bluestreet≤1.7.3No patch available
CVE-2026-39617—
High8.1Unauthenticated Local File Inclusion
Plank - Carpenter, Flooring & Woodworker WordPress Theme≤1.7No patch available
CVE-2025-69398—
Medium4.3Cross-Site Request Forgery
Easy Table of Contents≤2.0.80Update to 2.0.81
CVE-2026-32343—
Medium6.1Reflected Cross-Site Scripting
JetEngine≤3.8.0Update to 3.8.1
CVE-2025-68495—
High7.5Authenticated (Contributor+) PHP Object Injection
Image Gallery≤1.6.0Update to 1.6.1
CVE-2026-22345—
Medium5.3Missing Authorization
New User Approve≤3.2.0Update to 3.2.1
CVE-2025-69063—
Medium6.1Reflected Cross-Site Scripting
Diamond≤2.4.8No patch available
CVE-2025-69391—
Medium6.1Reflected Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS≤7.2.3Update to 7.3.0
CVE-2026-22352—
Medium6.1Reflected Cross-Site Scripting
Prestige<1.4.1Update to 1.4.1
CVE-2025-69330—
Medium4.3Missing Authorization
PDF for WPForms + Drag and Drop Template Builder≤6.3.0Update to 6.3.1
CVE-2025-68534—
Medium4.3Cross-Site Request Forgery
Appointment≤3.7.3Update to 3.7.4
CVE-2026-39620—
Medium5.3Missing Authorization
WP FullCalendar≤1.6Update to 1.6.1
CVE-2026-22351—
Medium4.8Missing Authentication to Unauthenticated Migrated Course Deletion
LearnPress – Backup & Migration Tool≤4.1.0Update to 4.1.1
CVE-2026-1787—
High8.1Unauthenticated Local File Inclusion
R&F - Roof & Floor Carpenter WordPress Theme≤1.5No patch available
CVE-2025-69402—
High8.1Unauthenticated Local File Inclusion
Diza - Pharmacy Store Elementor WooCommerce Theme≤1.3.15Update to 1.3.16
CVE-2025-68543—
High8.1Unauthenticated Local File Inclusion
Fana - Fashion Shop WordPress Theme≤1.1.35Update to 1.1.36
CVE-2025-68539—
High8.1Unauthenticated Local File Inclusion
Nika - Medical Elementor WooCommerce Theme≤1.2.14Update to 1.2.15
CVE-2025-68545—
Medium6.1Reflected Cross-Site Scripting
iMoney≤0.36No patch available
CVE-2025-69392—
Medium5.3Missing Authorization
Biolife - Organic Food WordPress Theme ( RTL Supported )≤3.2.3No patch available
CVE-2026-39624—
High8.1Unauthenticated Local File Inclusion
Cobble≤1.7No patch available
CVE-2025-69399—
Medium5.3Missing Authorization
Electronics eCommerce WordPress Woocommerce Theme - Exzo≤1.2.4No patch available
CVE-2025-69393—
High8.8Authenticated (Subscriber+) Arbitrary File Upload
Bravis Addons≤1.3.0Update to 1.3.1
CVE-2025-69403—
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Embed PDF Viewer≤2.4.7Update to 2.4.8
CVE-2026-32349—

Search VulnCrest Radar

Jump to

Are you sure?