WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Ultimate Addons for Elementor <= 1.45.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-66688
Jul 29, 2026
Researcher: Nguyen Ba Khanh - HPT Vietnam Corporation
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 - Missing Authorization
5.3
CVE-2026-66701
Jul 29, 2026
Researcher: Ananda Dhakal
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-66703
Jul 29, 2026
Researcher: Ananda Dhakal
AnsPress – Question and answer 4.4.4 - Missing Authorization
4.3
CVE-2026-65554
Jul 29, 2026
Researcher: Taylsec
Colissimo shipping methods for WooCommerce <= 2.10.0 - Authenticated (Customer+) Insecure Direct Object Reference
4.3
CVE-2026-66692
Jul 29, 2026
Researcher: TurboNexic
myCred <= 3.1.2 - Missing Authorization
4.3
CVE-2026-61968
Jul 29, 2026
Researcher: Riyas M S
Link Library < 7.9.4 - Reflected Cross-Site Scripting
6.1
CVE-2026-18197
Jul 29, 2026
Researcher: Joshua Martinelle
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings
8.8
CVE-2026-14270
Jul 28, 2026
Researcher: bashu
Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-8791
Jul 28, 2026
Researcher: Hardik Patel
Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
7.2
CVE ID Unknown
Jul 28, 2026
Researcher: Nguyen Truong (Roll)
WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute
6.4
CVE-2026-7436
Jul 28, 2026
Researcher: zaim
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
6.5
CVE-2026-5060
Jul 28, 2026
Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)
FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
4.3
CVE-2026-5582
Jul 28, 2026
Researcher: Deadbee
WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery
4.9
CVE-2026-6089
Jul 28, 2026
Researchers: Nguyen Quang Truong, Chu Thao Mai
Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
5.3
CVE-2026-4604
Jul 28, 2026
Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)
Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter
9.1
CVE-2026-14488
Jul 28, 2026
Researcher: Austin Ginder
Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter
9.8
CVE-2026-14900
Jul 28, 2026
Researcher: Nox Axter
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
7.2
CVE-2026-16655
Jul 28, 2026
Researcher: daroo
GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
7.2
CVE-2026-16597
Jul 28, 2026
Researcher: lhking
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation
9.8
CVE-2025-10656
Jul 28, 2026
Researcher: kr0d
Title CVE ID CVSS Researchers Date
Ultimate Addons for Elementor <= 1.45.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-66688 6.4 Nguyen Ba Khanh - HPT Vietnam Corporation July 29, 2026
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 - Missing Authorization CVE-2026-66701 5.3 Ananda Dhakal July 29, 2026
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-66703 6.4 Ananda Dhakal July 29, 2026
AnsPress – Question and answer 4.4.4 - Missing Authorization CVE-2026-65554 4.3 Taylsec July 29, 2026
Colissimo shipping methods for WooCommerce <= 2.10.0 - Authenticated (Customer+) Insecure Direct Object Reference CVE-2026-66692 4.3 TurboNexic July 29, 2026
myCred <= 3.1.2 - Missing Authorization CVE-2026-61968 4.3 Riyas M S July 29, 2026
Link Library < 7.9.4 - Reflected Cross-Site Scripting CVE-2026-18197 6.1 Joshua Martinelle July 29, 2026
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings CVE-2026-14270 8.8 bashu July 28, 2026
Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-8791 6.4 Hardik Patel July 28, 2026
Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter 7.2 Nguyen Truong (Roll) July 28, 2026
WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute CVE-2026-7436 6.4 zaim July 28, 2026
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion CVE-2026-5060 6.5 Md. Moniruzzaman Prodhan (NomanProdhan) July 28, 2026
FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle CVE-2026-5582 4.3 Deadbee July 28, 2026
WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery CVE-2026-6089 4.9 Nguyen Quang Truong, Chu Thao Mai July 28, 2026
Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update CVE-2026-4604 5.3 Md. Moniruzzaman Prodhan (NomanProdhan) July 28, 2026
Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter CVE-2026-14488 9.1 Austin Ginder July 28, 2026
Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter CVE-2026-14900 9.8 Nox Axter July 28, 2026
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member CVE-2026-16655 7.2 daroo July 28, 2026
GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields CVE-2026-16597 7.2 lhking July 28, 2026
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation CVE-2025-10656 9.8 kr0d July 28, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 13, 2026
Vulns
1 Wordfence PRISM 102
2 Ananda Dhakal 75
3 daroo 23
4 dutafi 10
5 Nabil Irawan 9
6 Legion Hunter 8
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Rafie Muhammad 6
9 Abdullah Kareem "cyberkareem" 6
10 Itthidej Aramsri (Boeing777) 6
11 Que Thanh Tuan 6
12 Phat RiO 6
13 Dmitrii Ignatyev 5
14 hhhai 5
15 luc 5
16 Nguyen Ba Khanh 5
17 Bao - BlueRock 4
18 VanTastic 4
19 Md. Moniruzzaman Prodhan (NomanProdhan) 4
20 Asaf Mozes 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation