VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 98)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software
Active filters:Clear all

41,244 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 98)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3Missing Authorization
Mailchimp for WooCommerce≤6.2Update to 6.3
CVE-2026-92437—
Medium6.4Authenticated (Translator+) Stored Cross-Site Scripting
Loco Translate≤2.8.8Update to 2.8.9
CVE-2026-94239—
High7.5Unauthenticated SQL Injection
SaveTo Wishlist Lite – WooCommerce Wishlist≤1.1.4Update to 1.1.5
CVE-2026-89236—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kubio AI Page Builder≤2.9.2Update to 2.9.3
CVE-2026-88782—
Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Emails
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤4.3.0Update to 4.3.1
CVE-2026-86833—
High7.2Authenticated (Admin+) Arbitrary File Write
Unlimited Elements for Elementor≤2.0.20Update to 2.0.21
CVE-2026-85015—
Medium4.49.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export7.17 – 9.1Update to 9.2
CVE-2026-80517—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Horizontal scrolling announcements≤2.6No patch available
CVE-2026-17005—
Medium4.3Unauthenticated Two-Factor Authentication Bypass
WP 2FA – Two-factor authentication for WordPress≤4.0.0Update to 4.1.0
CVE-2026-103514—
High7.3Unauthenticated Captcha Verification Bypass
hCaptcha for WP≤5.3.0Update to 5.4.0
CVE-2026-103347—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101890—
High8.8Authenticated (Admin+) Arbitrary File Upload
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101888—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-101162—
High7.2Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.2.1
CVE-2026-92144—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns≤6.4.5Update to 6.4.6
CVE-2026-96256—
Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads≤2.8.18Update to 2.8.19
CVE-2026-89427—
High7.2Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.2.1
CVE-2026-85235—
High7.2Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
PDF Invoices & Packing Slips for WooCommerce≤5.16.1Update to 5.16.2
CVE-2026-92244—
High7.2Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
Business Essentials for Contact Form 7≤1.2.1Update to 1.2.2
CVE-2026-97661—
High8.1Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Super Forms – Drag & Drop Form Builder≤6.3.316Update to 6.3.317
CVE-2026-15983—
Medium4.7Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More≤5.5.1.3Update to 5.5.1.4
CVE-2026-100184—
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More≤5.5.1.3Update to 5.5.1.4
CVE-2026-100179—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
bbp style pack≤6.4.8Update to 6.4.9
CVE-2026-101925—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
Awesome Support – WordPress HelpDesk & Support Plugin≤6.4.0Update to 6.4.1
CVE-2026-96268—
High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
Autoptimize≤3.1.15.1Update to 3.1.16
CVE-2026-14995—
High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
Appointment Hour Booking – Booking Calendar≤1.5.97Update to 1.5.98
CVE-2026-96573—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
Redux Framework≤4.5.14Update to 4.5.15
CVE-2026-90992—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter
Duplicate Post≤1.5.6Update to 1.5.7
CVE-2026-89424—
High7.2Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.47Update to 1.15.48
CVE-2026-96813—
High8.8Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
WPC Shop as a Customer for WooCommerce≤2.0.0Update to 2.0.1
CVE-2026-95687—

Search VulnCrest Radar

Jump to

Are you sure?