Top 10 Offending IPs from IP Threat Feed
Past 24 hours
# IP Address Blocked Attacks
1 36.255.97.23 1,215,609
2 43.228.157.194 1,187,998
3 64.89.161.90 1,175,145
4 62.60.130.235 962,321
5 23.132.164.122 777,081
6 188.166.253.199 761,666
7 62.60.130.230 744,893
8 141.145.153.109 734,017
9 161.33.228.223 673,492
10 167.172.80.70 655,657
Top 5 Generic Vulnerabilities Blocked by Wordfence
Past 24 hours
# Vulnerability
1 Directory Traversal
2 SQL Injection
3 XSS: Cross Site Scripting
4 LFI: Local File Inclusion
5 Directory Traversal via HTTP Headers
Top 10 Unique WordPress Vulnerabilities Blocked by Wordfence
Past 24 hours
# Vulnerability
1 WPGraphQL <= 0.2.3 - Multiple Vulnerable Actions
2 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
3 WAF-RULE-945
4 WordPress Core < 7.0.2 - Unauthenticated Remote Code Execution
5 Slider Revolution < 3.0.96 & Showbiz Pro < 1.7.1 - Missing Authorization to Arbitrary File Upload
6 WAF-RULE-868
7 Gwolle Guestbook <= 1.5.3 - Remote File Inclusion
8 WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
9 WAF-RULE-916
10 Ninja Forms <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

Recently Added Vulnerabilities

Submit Vulnerability View All
Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
4.3
CVE-2026-108092
Oct 14, 2026
Researcher: Kazuma Matsumoto
Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
4.3
CVE-2026-11905
Oct 14, 2026
Researcher: Or Benit
Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
7.2
CVE-2026-88043
Oct 14, 2026
Researcher: John Ryan Albon
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
6.5
CVE-2026-86803
Oct 14, 2026
Researcher: hashiramasenju333
VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
6.4
CVE-2026-78087
Oct 14, 2026
Researcher: theviper17y
Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
6.4
CVE-2026-78001
Oct 14, 2026
Researcher: Omar Elshopky (3l5h0pky)
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
7.2
CVE-2026-18586
Oct 14, 2026
Researcher: thevietronin
Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
7.2
CVE-2026-18548
Oct 14, 2026
Researcher: thevietronin
Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
6.1
CVE-2026-18557
Oct 14, 2026
Researcher: Dmitrii Ignatyev
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
6.4
CVE-2026-17001
Oct 14, 2026
Researcher: Luca Laytynher (LyT)
# Title CVE ID CVSS Researchers Date
1 Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure CVE-2026-108092 4.3 Kazuma Matsumoto October 14, 2026
2 Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters CVE-2026-11905 4.3 Or Benit October 14, 2026
3 Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter CVE-2026-88043 7.2 John Ryan Albon October 14, 2026
4 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template CVE-2026-86803 6.5 hashiramasenju333 October 14, 2026
5 VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature CVE-2026-78087 6.4 theviper17y October 14, 2026
6 Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute CVE-2026-78001 6.4 Omar Elshopky (3l5h0pky) October 14, 2026
7 Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' CVE-2026-18586 7.2 thevietronin October 14, 2026
8 Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter CVE-2026-18548 7.2 thevietronin October 14, 2026
9 Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter CVE-2026-18557 6.1 Dmitrii Ignatyev October 14, 2026
10 Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields CVE-2026-17001 6.4 Luca Laytynher (LyT) October 14, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 15, 2026
Vulns
1 Ananda Dhakal 193
2 Wordfence PRISM 70
3 Intrudify 48
4 João Pedro S Alcântara 42
5 nh4tvd 39
6 johska 34
7 Jakub Herman 31
8 Karthik Ramakrishnan 30
9 Naoki Kawahigashi 28
10 Artus KG 28

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation