VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 60)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software
Active filters:Clear all

41,244 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 60)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board≤2.4.3Update to 2.4.4
CVE-2026-104761—
High7.5Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes≤10.3.1Update to 10.3.2
CVE-2026-110284—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress≤3.2.19Update to 3.2.20
CVE-2026-103907—
High7.4Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.2Update to 5.7.3
CVE-2026-100163—
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.3Update to 5.7.4
CVE-2026-103366—
Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.3Update to 5.7.4
CVE-2026-103380—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.190Update to 2.8.191
CVE-2026-107650—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.190Update to 2.8.191
CVE-2026-107754—
Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
Gallery Custom Links≤2.3.3Update to 2.3.4
CVE-2026-107757—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
Social Share Buttons & Analytics Plugin – GetSocial.io≤4.5No patch available
CVE-2026-103369—
High7.2Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
NewStatPress≤1.4.5No patch available
CVE-2026-101924—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
Hyyan Integration for WooCommerce and Polylang≤1.5.0No patch available
CVE-2026-101926—
High7.2Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
NewStatPress≤1.4.5No patch available
CVE-2026-100153—
High7.5Unauthenticated SQL Injection via 'gmedia__in' Parameter
Gmedia Photo Gallery≤1.25.1No patch available
CVE-2026-96661—
High7.2Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
Smart Forms – when you need more than just a contact form≤2.6.104No patch available
CVE-2026-95816—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
Countdown Timer – Widget Countdown3.0.0 – 3.0.1No patch available
CVE-2026-16495—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
PO/MO Editor≤1.4.2No patch available
CVE-2026-97020—
High7.5Unauthenticated SQL Injection
JTL-Connector for WooCommerce≤2.4.3No patch available
CVE-2026-78193—
High7.2Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
Verified Reviews (Avis Vérifiés)≤2.4.6No patch available
CVE-2026-94377—
High7.2Unauthenticated Stored Cross-Site Scripting via data_object Parameter
Cryptocurrency Donation Box – Bitcoin & Crypto Donations≤2.2.13No patch available
CVE-2026-93885—
High7.2Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
Contact Form DB for Enfold≤2.0.2No patch available
CVE-2026-83592—
Critical9.1Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
BuddyPress XProfile Custom Image Field≤3.1.0No patch available
CVE-2026-120518—
Critical9.8Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
AGE-GATE≤1.0No patch available
CVE-2026-104800—
Critical9.8Unauthenticated Arbitrary File Upload via 'image.push' Method
JTL-Connector for WooCommerce≤2.4.3No patch available
CVE-2026-87855—
Medium4.7Reflected Cross-Site Scripting via 'tab' Parameter
Tutor LMS – eLearning and online course solution≤4.1.0Update to 4.1.1
CVE-2026-100193—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
FV Player 8≤8.1.7Update to 8.1.8
CVE-2026-95807—
High7.2Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
FV Flowplayer Video Player≤7.5.54.7212Update to 7.5.55.7212
CVE-2026-97398—
Medium5.3Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
Avada (Fusion) Builder≤3.16.1Update to 3.16.2
CVE-2026-97471—
High7.5Unauthenticated SQL Injection via 'inputs' Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.48Update to 1.15.49
CVE-2026-95808—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
Directorist: AI-Powered Business Directory, Listings & Classified Ads≤8.10.2.1Update to 8.10.3
CVE-2026-100185—

Search VulnCrest Radar

Jump to

Are you sure?