Top 10 Offending IPs from IP Threat Feed
Past 24 hours
# IP Address Blocked Attacks
1 20.197.198.154 4,057,322
2 102.220.160.153 1,574,166
3 62.60.130.228 1,482,978
4 62.60.130.210 1,394,279
5 64.89.163.68 1,285,082
6 20.48.233.63 1,260,471
7 2.58.56.112 1,124,485
8 185.242.3.184 1,057,075
9 193.47.62.168 999,567
10 185.242.3.189 960,251
Top 5 Generic Vulnerabilities Blocked by Wordfence
Past 24 hours
# Vulnerability
1 SQL Injection
2 Directory Traversal
3 Directory Traversal via HTTP Headers
4 XSS: Cross Site Scripting
5 Malicious File Upload
Top 10 Unique WordPress Vulnerabilities Blocked by Wordfence
Past 24 hours
# Vulnerability
1 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
2 GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
3 WPGraphQL <= 0.2.3 - Multiple Vulnerable Actions
4 WAF-RULE-916
5 WooCommerce Payments <= 5.6.1 Authentication Bypass and Privilege Escalation
6 Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
7 Discount Rules for WooCommerce < 2.1.0 - Missing Authorization
8 N-Media Post Front-end Form < 1.1 - Arbitrary File Upload
9 LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation
10 Rank Math SEO <= 1.0.40.2 - Unprotected REST API Endpoints

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

Recently Added Vulnerabilities

Submit Vulnerability View All
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
7.5
CVE-2026-12997
Jul 15, 2026
Researcher: daroo
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
9.8
CVE-2026-13001
Jul 14, 2026
Researcher: Talal Nasraddeen
WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
6.4
CVE-2026-7640
Jul 13, 2026
Researcher: zaim
FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
5.3
CVE-2026-11802
Jul 13, 2026
Researcher: Eason
News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets
6.4
CVE-2026-11390
Jul 13, 2026
Researcher: Romain Deperne (ang3L)
Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
6.4
CVE-2026-12536
Jul 13, 2026
Researcher: Zbigniew Piotrak
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
4.3
CVE-2026-12385
Jul 13, 2026
Researcher: Yuvraj Tomar
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
9.8
CVE ID Unknown
Jul 13, 2026
Researcher: lb
Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
4.3
CVE-2026-9341
Jul 13, 2026
Researcher: sorawautsukushiii
Bulk Edit Products for WooCommerce – WP Sheet Editor <= 1.8.21 - Missing Authorization
4.3
CVE-2026-61952
Jul 12, 2026
Researcher: Ananda Dhakal
# Title CVE ID CVSS Researchers Date
1 Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter CVE-2026-12997 7.5 daroo July 15, 2026
2 Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter CVE-2026-13001 9.8 Talal Nasraddeen July 14, 2026
3 WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute CVE-2026-7640 6.4 zaim July 13, 2026
4 FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action CVE-2026-11802 5.3 Eason July 13, 2026
5 News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets CVE-2026-11390 6.4 Romain Deperne (ang3L) July 13, 2026
6 Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title CVE-2026-12536 6.4 Zbigniew Piotrak July 13, 2026
7 Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter CVE-2026-12385 4.3 Yuvraj Tomar July 13, 2026
8 Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function' 9.8 lb July 13, 2026
9 Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter CVE-2026-9341 4.3 sorawautsukushiii July 13, 2026
10 Bulk Edit Products for WooCommerce – WP Sheet Editor <= 1.8.21 - Missing Authorization CVE-2026-61952 4.3 Ananda Dhakal July 12, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jun 15, 2026
Vulns
1 PRISM 53
2 daroo 50
3 João Pedro S Alcântara (Kinorth) 45
4 Ananda Dhakal 36
5 Nguyen Ba Khanh 27
6 dodoh4t 18
7 Chloe Chamberland 17
8 Bonds 15
9 Nabil Irawan 15
10 ParkHyunWoo 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation