VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-22Vulnerability type

WordPress Path Traversal vulnerabilities (page 59)

File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Path Traversal vulnerabilities (page 59)
SeverityVulnerabilityCVEInstallsPublished
High7.5Unauthenticated SQL Injection
Green Popups<7.6.3Update to 7.6.3
CVE-2026-94388—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Donation Thermometer<2.3.0Update to 2.3.0
CVE-2026-92409—
High7.55.2.3 - Unauthenticated SQL Injection
Fast Courier – Shipping & Freight5.0.0 – 5.2.3Update to 5.2.4
CVE-2026-89288—
High8.8Authenticated (Contributor+) Remote Code Execution
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display<3.9.1Update to 3.9.1
CVE-2026-86787—
Low2.7Authenticated (Administrator+) Insecure Direct Object Reference
WP 2FA – Two-factor authentication for WordPress<4.2.0Update to 4.2.0
CVE-2026-108066—
Critical9.8Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications≤3.10.0Update to 3.10.1
CVE-2026-104748—
High7.2Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
Record of Consent Extension for Complianz≤2.5Update to 2.6
CVE-2026-107631—
High8.1Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
ShopMagic – email automation for WordPress≤4.9.0Update to 4.9.1
CVE-2026-103367—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PeproDev Branches Map (Mapify)≤3.0.1Update to 3.0.2
CVE-2025-9373—
High7.2Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
Post Export Import with Media≤1.17.1Update to 1.17.2
CVE-2026-104764—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
Meow Lightbox≤5.6.2Update to 5.6.3
CVE-2026-107756—
High8.1Unauthenticated Local File Inclusion via '<mode>_type' Parameter
Mang Board≤2.4.3Update to 2.4.4
CVE-2026-104909—
High7.2Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
Mang Board≤2.4.3Update to 2.4.4
CVE-2026-107751—
Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board≤2.4.3Update to 2.4.4
CVE-2026-104761—
High7.5Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes≤10.3.1Update to 10.3.2
CVE-2026-110284—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress≤3.2.19Update to 3.2.20
CVE-2026-103907—
High7.4Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.2Update to 5.7.3
CVE-2026-100163—
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.3Update to 5.7.4
CVE-2026-103366—
Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.3Update to 5.7.4
CVE-2026-103380—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.190Update to 2.8.191
CVE-2026-107650—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.190Update to 2.8.191
CVE-2026-107754—
Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
Gallery Custom Links≤2.3.3Update to 2.3.4
CVE-2026-107757—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
Social Share Buttons & Analytics Plugin – GetSocial.io≤4.5No patch available
CVE-2026-103369—
High7.2Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
NewStatPress≤1.4.5No patch available
CVE-2026-101924—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
Hyyan Integration for WooCommerce and Polylang≤1.5.0No patch available
CVE-2026-101926—
High7.2Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
NewStatPress≤1.4.5No patch available
CVE-2026-100153—
High7.5Unauthenticated SQL Injection via 'gmedia__in' Parameter
Gmedia Photo Gallery≤1.25.1No patch available
CVE-2026-96661—
High7.2Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
Smart Forms – when you need more than just a contact form≤2.6.104No patch available
CVE-2026-95816—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
Countdown Timer – Widget Countdown3.0.0 – 3.0.1No patch available
CVE-2026-16495—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
PO/MO Editor≤1.4.2No patch available
CVE-2026-97020—

Search VulnCrest Radar

Jump to

Are you sure?