Database
WordPress Vulnerability Database (page 79)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Missing Authorization | CVE-2026-42706 | — | |
| Medium6.1 | Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting | CVE-2026-57742 | — | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection | CVE-2026-42708 | — | |
| Medium6.5 | Authenticated (Author+) SQL Injection | CVE-2026-42710 | — | |
| High7.5 | Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion | CVE-2026-82627 | — | |
| Medium5.4 | Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification | CVE-2026-17538 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting via 'url' Parameter | CVE-2026-94154 | — | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection | CVE-2026-42713 | — | |
| Medium4.9 | Authenticated (Shop Manager+) SQL Injection | CVE-2026-42714 | — | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection | CVE-2026-42720 | — | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection | CVE-2026-42721 | — | |
| Medium5.3 | Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization | CVE-2026-27434 | — | |
| Medium4.3 | Missing Authorization | CVE-2026-104390 | — | |
| Medium5.3 | Unauthenticated Information Exposure | CVE-2026-105876 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates≤3.50.0Update to 3.50.1 | CVE-2026-104393 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons≤4.6.2Update to 4.7.0 | CVE-2026-105875 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-104391 | — | |
| Medium4.3 | Missing Authorization | CVE-2026-103075 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-105884 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-105873 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-97294 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-105871 | — | |
| Medium6.4 | 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Medium4.8 | 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export | — | — | |
| High8.1 | Unauthenticated Local File Inclusion | CVE-2026-62115 | — | |
| Medium4.3 | 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Medium4.3 | 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Low3.3 | 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Medium5.3 | Missing Authorization | CVE-2026-106601 | — | |
| Medium5.3 | Missing Authorization | CVE-2026-97075 | — |
- Medium5.3Missing Authorization
DK
≤3.2.1No patch available
- Medium6.1Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting
Kids Planet - Children Kindergarten and Playgroup WordPress Theme
≤2.2.14.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.0.0Update to 4.0.1
- Medium6.5Authenticated (Author+) SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.63No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.6.1.1Update to 7.7.0
- Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.9Update to 5.6.10
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Aurora Heatmap
≤1.7.2Update to 1.7.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Post title marquee scroll
≤9.9No patch available
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Pix por Piggly (para Woocommerce)
≤2.1.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Dynamic User Directory
≤2.4No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.1Update to 3.9.2
- Medium5.3Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
WP Rentals - Booking Accommodation WordPress Theme
≤3.14.2No patch available
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.27Update to 1.0.28
- Medium5.3Unauthenticated Information Exposure
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.50.0Update to 3.50.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.6.2Update to 4.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium4.3Missing Authorization
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.2Update to 7.8.14.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7
- Medium6.47.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Medium4.87.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export
WordPress
≤7.1.2Update to 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- High8.1Unauthenticated Local File Inclusion
kuteshop
≤4.2.9No patch available
- Medium4.37.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Medium4.37.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Low3.37.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Medium5.3Missing Authorization
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤16.2Update to 16.3
- Medium5.3Missing Authorization
WP Rocket
<3.23.5Update to 3.23.5