Database

WordPress Vulnerability Database (page 63)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 63)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	Unauthenticated Remote Code Execution AjaxLoadMore Cache≤3.1.1No patch available	CVE-2026-61991	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Weaver Xtreme Theme Support≤7.0.1No patch available	CVE-2026-54870	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting IMPress for IDX Broker≤3.3.1No patch available	CVE-2026-54869	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting FV Simpler SEO≤1.9.7Update to 1.9.8	CVE-2026-54868	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Responsive Slider≤0.1.9No patch available	CVE-2026-54867	—	Oct 13
High8.1	Unauthenticated PHP Object Injection Quirky - NFT, Token & Artist Marketplace WordPress Theme≤1.23No patch available	CVE-2026-54857	—	Oct 13
Medium5.3	Missing Authorization Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.25Update to 4.1.26	CVE-2026-109898	—	Oct 13
Medium4.3	Missing Authorization Download Monitor integration for WooCommerce≤1.0.3Update to 1.0.4	CVE-2026-109896	—	Oct 13
Medium5.3	Missing Authorization Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates≤4.11.110Update to 4.11.111	CVE-2026-109890	—	Oct 13
Medium5.3	Unauthenticated Information Exposure WPGraphQL≤2.26.0Update to 2.26.1	CVE-2026-109703	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments≤4.9.4Update to 4.9.5	CVE-2026-109697	—	Oct 13
Medium4.3	Missing Authorization FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration≤2.1.0Update to 2.2.0	CVE-2026-109696	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons≤4.7.1Update to 4.7.2	CVE-2026-109691	—	Oct 13
Medium4.9	Authenticated (Editor+) SQL Injection Link Whisper Free≤0.9.7Update to 0.9.8	CVE-2026-109687	—	Oct 13
Medium5.3	Missing Authorization Booking for Appointments and Events Calendar – Amelia≤2.4.10Update to 2.4.11	CVE-2026-109684	—	Oct 13
High7.3	Unauthenticated Privilege Escalation User Rights Access Manager≤1.1.3No patch available	CVE-2026-109145	—	Oct 13
Medium5.3	Missing Authorization WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory≤2.9.23Update to 2.9.24	CVE-2026-108496	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.12.7Update to 2.12.8	CVE-2026-108495	—	Oct 13
Medium5.3	Missing Authorization Quick PayPal Payments: Payment Button & Form≤6.0.3Update to 6.0.4	CVE-2026-108492	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates≤4.11.110Update to 4.11.111	CVE-2026-108490	—	Oct 13
Medium5.3	Unauthenticated Information Exposure Active Woot Products Tables for WooCommerce. 100% FREE ≤2.1.3Update to 2.1.4	CVE-2026-108489	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting PowerPack Addons for Elementor: Widgets, Form Styler and Templates≤3.1.0Update to 3.1.1	CVE-2026-108488	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Books Gallery – Book Showcase, Library & Affiliate Plugin≤4.8.4Update to 4.8.5	CVE-2026-108487	—	Oct 13
Medium4.9	Authenticated (Editor+) SQL Injection WOLF – WordPress Posts Bulk Editor and Manager Professional≤1.1.1Update to 1.1.2	CVE-2026-108179	—	Oct 13
Medium5.3	Missing Authorization FOX – Currency Switcher Professional for WooCommerce≤1.5.4Update to 1.5.5	CVE-2026-108174	—	Oct 13
Medium5.3	Unauthenticated Information Exposure User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.2.8Update to 5.3.0	CVE-2026-106598	—	Oct 13
Medium5.3	Missing Authorization User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.2.8Update to 5.3.0	CVE-2026-106597	—	Oct 13
Medium5.3	Missing Authorization Spin Wheel – Interactive spinning wheel that offers coupons≤2.2.0Update to 2.2.1	CVE-2026-106031	—	Oct 13
Medium4.3	Authenticated (Subscriber+) Information Exposure Visual Form Builder≤3.1No patch available	CVE-2026-105974	—	Oct 13
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.2.8Update to 5.3.0	CVE-2026-105881	—	Oct 13

Critical9.8
Unauthenticated Remote Code Execution
AjaxLoadMore Cache
≤3.1.1No patch available
CVE-2026-61991Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Weaver Xtreme Theme Support
≤7.0.1No patch available
CVE-2026-54870Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
IMPress for IDX Broker
≤3.3.1No patch available
CVE-2026-54869Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
FV Simpler SEO
≤1.9.7Update to 1.9.8
CVE-2026-54868Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Responsive Slider
≤0.1.9No patch available
CVE-2026-54867Oct 13
High8.1
Unauthenticated PHP Object Injection
Quirky - NFT, Token & Artist Marketplace WordPress Theme
≤1.23No patch available
CVE-2026-54857Oct 13
Medium5.3
Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
CVE-2026-109898Oct 13
Medium4.3
Missing Authorization
Download Monitor integration for WooCommerce
≤1.0.3Update to 1.0.4
CVE-2026-109896Oct 13
Medium5.3
Missing Authorization
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
CVE-2026-109890Oct 13
Medium5.3
Unauthenticated Information Exposure
WPGraphQL
≤2.26.0Update to 2.26.1
CVE-2026-109703Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
CVE-2026-109697Oct 13
Medium4.3
Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.1.0Update to 2.2.0
CVE-2026-109696Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.1Update to 4.7.2
CVE-2026-109691Oct 13
Medium4.9
Authenticated (Editor+) SQL Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
CVE-2026-109687Oct 13
Medium5.3
Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
CVE-2026-109684Oct 13
High7.3
Unauthenticated Privilege Escalation
User Rights Access Manager
≤1.1.3No patch available
CVE-2026-109145Oct 13
Medium5.3
Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.23Update to 2.9.24
CVE-2026-108496Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.7Update to 2.12.8
CVE-2026-108495Oct 13
Medium5.3
Missing Authorization
Quick PayPal Payments: Payment Button & Form
≤6.0.3Update to 6.0.4
CVE-2026-108492Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
CVE-2026-108490Oct 13
Medium5.3
Unauthenticated Information Exposure
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.3Update to 2.1.4
CVE-2026-108489Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
CVE-2026-108488Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.4Update to 4.8.5
CVE-2026-108487Oct 13
Medium4.9
Authenticated (Editor+) SQL Injection
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.1.1Update to 1.1.2
CVE-2026-108179Oct 13
Medium5.3
Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.4Update to 1.5.5
CVE-2026-108174Oct 13
Medium5.3
Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
CVE-2026-106598Oct 13
Medium5.3
Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
CVE-2026-106597Oct 13
Medium5.3
Missing Authorization
Spin Wheel – Interactive spinning wheel that offers coupons
≤2.2.0Update to 2.2.1
CVE-2026-106031Oct 13
Medium4.3
Authenticated (Subscriber+) Information Exposure
Visual Form Builder
≤3.1No patch available
CVE-2026-105974Oct 13
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
CVE-2026-105881Oct 13