Database
WordPress Vulnerability Database (page 79)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting via 'url' Parameter | CVE-2026-94154 | — | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection | CVE-2026-42713 | — | |
| Medium4.9 | Authenticated (Shop Manager+) SQL Injection | CVE-2026-42714 | — | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection | CVE-2026-42720 | — | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection | CVE-2026-42721 | — | |
| Medium5.3 | Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization | CVE-2026-27434 | — | |
| Medium4.3 | Missing Authorization | CVE-2026-104390 | — | |
| Medium5.3 | Unauthenticated Information Exposure | CVE-2026-105876 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates≤3.50.0Update to 3.50.1 | CVE-2026-104393 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons≤4.6.2Update to 4.7.0 | CVE-2026-105875 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-104391 | — | |
| Medium4.3 | Missing Authorization | CVE-2026-103075 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-105884 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-105873 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-97294 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2026-105871 | — | |
| Medium6.4 | 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Medium4.8 | 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export | — | — | |
| High8.1 | Unauthenticated Local File Inclusion | CVE-2026-62115 | — | |
| Medium4.3 | 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Medium4.3 | 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Low3.3 | 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | — | — | |
| Medium5.3 | Missing Authorization | CVE-2026-106601 | — | |
| Medium5.3 | Missing Authorization | CVE-2026-97075 | — | |
| High7.5 | Authenticated (Subscriber+) PHP Object Injection | CVE-2026-94064 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2026-94063 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2026-94060 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2026-94058 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter | CVE-2026-85097 | — | |
| Medium5.3 | 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3 | CVE-2026-66666 | — |
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Aurora Heatmap
≤1.7.2Update to 1.7.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Post title marquee scroll
≤9.9No patch available
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Pix por Piggly (para Woocommerce)
≤2.1.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Dynamic User Directory
≤2.4No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.1Update to 3.9.2
- Medium5.3Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
WP Rentals - Booking Accommodation WordPress Theme
≤3.14.2No patch available
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.27Update to 1.0.28
- Medium5.3Unauthenticated Information Exposure
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.50.0Update to 3.50.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.6.2Update to 4.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium4.3Missing Authorization
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.2Update to 7.8.14.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7
- Medium6.47.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Medium4.87.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export
WordPress
≤7.1.2Update to 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- High8.1Unauthenticated Local File Inclusion
kuteshop
≤4.2.9No patch available
- Medium4.37.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Medium4.37.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Low3.37.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Medium5.3Missing Authorization
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤16.2Update to 16.3
- Medium5.3Missing Authorization
WP Rocket
<3.23.5Update to 3.23.5
- High7.5Authenticated (Subscriber+) PHP Object Injection
Neo | Barber Shop WordPress Theme
≤3.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Education Center | LMS & Online Courses WordPress Theme
≤3.6.12No patch available
- Medium6.1Reflected Cross-Site Scripting
Voldor - Welding & Metal Work WordPress Theme
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Treck - Immigration and Visa Consulting WordPress Theme
≤1.0.0No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
Bricksforge
≤3.1.8.9Update to 3.1.8.10
- Medium5.37.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3