VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 50)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,153 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 50)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN≤1.4.2Update to 1.4.3
CVE-2026-109985—
Medium4.9Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
Post Export Import with Media≤1.17.2Update to 1.18.0
CVE-2026-110268—
High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.2.8Update to 5.3.0
CVE-2026-92798—
Medium4.3Cross-Site Request Forgery to trigger_bulk_action()
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.2.8Update to 5.3.0
CVE-2026-92978—
High7.2Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.2.8Update to 5.3.0
CVE-2026-96660—
Medium6.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
WP Booking System – Booking Calendar≤2.1.0.3Update to 2.1.0.4
CVE-2026-109369—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
WP Booking System – Booking Calendar≤2.1.0.3Update to 2.1.0.4
CVE-2026-109368—
High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
WP Booking System – Booking Calendar≤2.1.0.3Update to 2.1.0.4
CVE-2026-108123—
High7.2Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
EU VAT Assistant for WooCommerce≤2.1.30.260413Update to 2.2.0
CVE-2026-103899—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
Themify Popup≤1.4.7Update to 1.4.8
CVE-2026-109989—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
Themify Builder≤7.8.2Update to 7.8.3
CVE-2026-111726—
Medium4.9Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
Welcart e-Commerce≤2.12.4Update to 2.12.5
CVE-2026-107752—
Critical9.8Unauthenticated PHP Object Injection via 'checkout-email' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.4.10Update to 4.4.11
CVE-2026-104736—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.4.10Update to 4.4.11
CVE-2026-107744—
Low3.7Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.4Update to 5.7.5
CVE-2026-111602—
High7.2Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.4.10Update to 4.4.11
CVE-2026-109208—
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer≤6.3.2Update to 6.4.0
CVE-2026-107762—
Critical9.1Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.4Update to 5.7.5
CVE-2026-110653—
Medium6.1Reflected Cross-Site Scripting via 'token_id' Parameter
Hippoo Mobile App for WooCommerce≤1.12.0Update to 1.12.1
CVE-2026-111601—
High7.2Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
Kirki – Freeform Page Builder, Website Builder & Customizer≤6.3.2Update to 6.4.0
CVE-2026-104734—
Medium4.3Cross-Site Request Forgery
aThemeArt Theme Helper≤1.0.8No patch available
CVE-2026-111413—
Medium5.3Missing Authorization
Passster – Password Protect Pages and Content≤4.3.18Update to 4.3.19
CVE-2026-110896—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates≤3.1.0Update to 3.1.1
CVE-2026-111400—
Medium4.3Missing Authorization
Advanced Post Manager≤4.5.6Update to 4.5.7
CVE-2026-111396—
Medium5.3Missing Authorization
YITH PayPal Express Checkout for WooCommerce≤1.61.0Update to 1.62.0
CVE-2026-111409—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar≤6.18.1Update to 6.18.2
CVE-2026-110903—
Medium5.3Missing Authorization
Bookit — Booking & Appointment Calendar≤2.6.0.5Update to 2.6.0.6
CVE-2026-110900—
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
SmartCrawl SEO checker, analyzer & optimizer≤3.16.4Update to 3.17.1
CVE-2026-110901—
Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.26Update to 4.1.27
CVE-2026-110380—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant≤8.16.1Update to 8.16.2
CVE-2026-111405—

Search VulnCrest Radar

Jump to

Are you sure?