VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 99)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software
Active filters:Clear all

41,244 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 99)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
Ad Inserter – Ad Manager & AdSense Ads≤2.8.18Update to 2.8.19
CVE-2026-19902—
High8.8Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
ByteCoreStack – MCP Connector for AI Tools≤1.2.3Update to 1.2.4
CVE-2026-19807—
Critical9.8Unauthenticated Privilege Escalation via 'role' Parameter
Super Forms – Drag & Drop Form Builder≤6.3.316Update to 6.3.317
CVE-2026-15989—
Critical9.8Unauthenticated Authentication Bypass via 'checkout_form' Parameter
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform≤2.15.0Update to 2.15.1
CVE-2026-75957—
Medium6.1Reflected DOM-Based Cross-Site Scripting via URL
Social Media Share Buttons & Social Sharing Icons≤3.0.1Update to 3.0.2
CVE-2026-89047—
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.4.8Update to 4.4.9
CVE-2026-93882—
High7.2Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
Extendify≤3.1.6Update to 3.2.0
CVE-2026-85679—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
Redux Framework≤4.5.14Update to 4.5.15
CVE-2026-88999—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.0Update to 5.7.1
CVE-2026-92966—
Medium5.3Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters
WP Popular Posts≤7.4.2Update to 7.4.3
CVE-2026-92548—
High7.2Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini≤3.8.0Update to 3.8.1
CVE-2026-96561—
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
Simply Schedule Appointments≤1.6.12.31Update to 1.6.12.33
CVE-2026-91109—
High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
Simply Schedule Appointments≤1.6.12.32Update to 1.6.12.33
CVE-2026-92245—
Medium5.3Missing Authorization
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key≤1.5.5Update to 1.6.1
CVE-2026-102397—
High7.2Unauthenticated Stored Cross-Site Scripting
Photonic Gallery & Lightbox for Flickr, SmugMug & Others≤3.36Update to 3.37
CVE-2026-97290—
High7.2Unauthenticated Stored Cross-Site Scripting
CURCY – Multi Currency for WooCommerce2.2.18 – 2.2.18Update to 2.2.19
CVE-2026-94171—
Medium5.3Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Newsletter – Send awesome emails from WordPress≤9.3.9Update to 9.4.0
CVE-2026-92537—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Branda – White Label & Branding, Free Login Page Customizer≤3.4.32Update to 3.4.33
CVE-2026-102376—
Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Extra Product Options For WooCommerce | Custom Product Addons and Fields≤3.3.8Update to 3.3.9
CVE-2026-102392—
High7.2Unauthenticated Stored Cross-Site Scripting
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor≤1.27.14Update to 1.27.15
CVE-2026-100510—
High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.5.4Update to 3.6.6
CVE-2026-102391—
High7.5Authenticated (Contributor+) PHP Object Injection
Nested Pages≤3.3.2Update to 3.3.3
CVE-2026-100512—
High7.5Authenticated (Contributor+) PHP Object Injection
Schema & Structured Data for WP & AMP≤1.66Update to 1.67
CVE-2026-97291—
High7.5Authenticated (Contributor+) PHP Object Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery≤1.8.46Update to 1.8.47
CVE-2026-102377—
Medium4.3Missing Authorization
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization≤4.2.14Update to 4.2.15
CVE-2026-102375200K+
High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine≤3.8.15.3Update to 3.8.15.4
CVE-2026-97265—
Medium6.6Authenticated (Editor+) PHP Object Injection
Page Builder by SiteOrigin≤2.36.0Update to 2.36.1
CVE-2026-97256—
High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.3Update to 3.15.5
CVE-2026-102385—
High7.2Unauthenticated Stored Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell≤3.13.1Update to 3.13.2
CVE-2026-97271—
Medium5.3Unauthenticated Insecure Direct Object Reference
Pay with Vipps and MobilePay for WooCommerce≤6.2.4Update to 6.2.5
CVE-2026-97259—

Search VulnCrest Radar

Jump to

Are you sure?