Top 10 Offending IPs from IP Threat Feed
Past 24 hours
# IP Address Blocked Attacks
1 36.255.97.23 1,078,929
2 43.228.157.173 1,068,842
3 140.245.55.9 969,313
4 64.89.161.160 812,555
5 45.148.10.238 770,548
6 206.189.146.19 678,411
7 152.42.199.142 659,087
8 139.59.232.32 649,718
9 149.118.67.149 646,481
10 64.89.163.34 645,123
Top 5 Generic Vulnerabilities Blocked by Wordfence
Past 24 hours
# Vulnerability
1 Directory Traversal
2 SQL Injection
3 XSS: Cross Site Scripting
4 LFI: Local File Inclusion
5 Malicious File Upload
Top 10 Unique WordPress Vulnerabilities Blocked by Wordfence
Past 24 hours
# Vulnerability
1 WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
2 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
3 WAF-RULE-945
4 WordPress Core < 7.0.2 - Unauthenticated Remote Code Execution
5 WooCommerce Payments <= 5.6.1 Authentication Bypass and Privilege Escalation
6 UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure
7 Rank Math SEO <= 1.0.40.2 - Unprotected REST API Endpoints
8 WPGraphQL <= 0.2.3 - Multiple Vulnerable Actions
9 SiteGround Optimizer <= 5.0.12 - Missing Authorization
10 WAF-RULE-916

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

Recently Added Vulnerabilities

Submit Vulnerability View All
ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
8.8
CVE-2026-105701
Oct 5, 2026
Researcher: d.v4n_s3c
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
7.2
CVE-2026-75962
Oct 5, 2026
Researcher: Adrien Brunner
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
6.4
CVE-2026-92767
Oct 2, 2026
Researcher: Dmitrii Ignatyev
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
9.1
CVE-2026-92084
Oct 2, 2026
Researcher: OKISO
Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
4.3
CVE-2026-97343
Oct 2, 2026
Researcher: crow
Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
8.1
CVE-2026-94505
Oct 2, 2026
Researcher: Wordfence PRISM
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
6.1
CVE-2026-92974
Oct 2, 2026
Researcher: r3foxx
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
6.1
CVE-2026-93896
Oct 2, 2026
Researcher: Nabil Irawan
WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
7.2
CVE-2026-97660
Oct 2, 2026
Researcher: Sebastian Albrecht (mySebbe)
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter
6.1
CVE-2026-104313
Oct 2, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
# Title CVE ID CVSS Researchers Date
1 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template CVE-2026-105701 8.8 d.v4n_s3c October 5, 2026
2 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log) CVE-2026-75962 7.2 Adrien Brunner October 5, 2026
3 Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute CVE-2026-92767 6.4 Dmitrii Ignatyev October 2, 2026
4 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output CVE-2026-92084 9.1 OKISO October 2, 2026
5 Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token' CVE-2026-97343 4.3 crow October 2, 2026
6 Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter CVE-2026-94505 8.1 Wordfence PRISM October 2, 2026
7 Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter CVE-2026-92974 6.1 r3foxx October 2, 2026
8 WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI CVE-2026-93896 6.1 Nabil Irawan October 2, 2026
9 WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name CVE-2026-97660 7.2 Sebastian Albrecht (mySebbe) October 2, 2026
10 WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter CVE-2026-104313 6.1 Osvaldo Noe Gonzalez Del Rio (Os) October 2, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 6, 2026
Vulns
1 Ananda Dhakal 75
2 Wordfence PRISM 65
3 Karthik Ramakrishnan 34
4 Artus KG 30
5 Jakub Herman 30
6 Intrudify 20
7 daroo 18
8 nh4tvd 17
9 Francisco José Ramírez Vicente 14
10 Erwan LR 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation