WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
4.9
CVE-2026-11920
Aug 4, 2026
Researcher: Nicolas Decayeux
MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action
8.1
CVE-2026-7520
Aug 4, 2026
Researcher: t0ann9uy3n
Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal
7.5
CVE ID Unknown
Aug 4, 2026
Researcher: KEVIN LEE (crattack)
ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
7.2
CVE-2026-6020
Aug 4, 2026
Researchers: Itthidej Aramsri (Boeing777), Waris Damkham, Teerachai Somprasong
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
6.5
CVE-2026-11454
Aug 4, 2026
Researcher: Lucius-log
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
4.3
CVE-2026-7105
Aug 4, 2026
Researcher: normaandersonfrank
User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-15281
Aug 4, 2026
Researcher: Nox Axter
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
6.5
CVE-2026-7456
Aug 4, 2026
Researcher: Legion Hunter
TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
7.5
CVE-2026-18881
Aug 4, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Waris Damkham
Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
9.1
CVE-2026-5581
Aug 4, 2026
Researcher: Riski Gana Prasetya
Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
7.3
CVE-2026-6079
Aug 4, 2026
Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
6.1
CVE-2026-17532
Aug 4, 2026
Researcher: Alireza
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
6.1
CVE-2026-17505
Aug 4, 2026
Researcher: momopon1415
LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload
8.8
CVE-2026-6147
Aug 4, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)
Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
7.5
CVE-2026-12000
Aug 4, 2026
Researcher: Mitchell
WPFormify <= 1.1.1 - Missing Authorization
8.2
CVE-2026-6627
Aug 4, 2026
Researcher: Legion Hunter
SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-6972
Aug 4, 2026
Researcher: zaim
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter
7.2
CVE-2026-7693
Aug 4, 2026
Researcher: at1as
Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2026-5116
Aug 4, 2026
Researcher: SATYARTH PRAKASH (XoxoL33t)
Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
6.5
CVE-2026-7726
Aug 4, 2026
Researchers: murd0ck, Patricio Briones (CyberDoomer)
Title CVE ID CVSS Researchers Date
JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter CVE-2026-11920 4.9 Nicolas Decayeux August 4, 2026
MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action CVE-2026-7520 8.1 t0ann9uy3n August 4, 2026
Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal 7.5 KEVIN LEE (crattack) August 4, 2026
ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API CVE-2026-6020 7.2 Itthidej Aramsri (Boeing777), Waris Damkham, Teerachai Somprasong August 4, 2026
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference CVE-2026-11454 6.5 Lucius-log August 4, 2026
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function CVE-2026-7105 4.3 normaandersonfrank August 4, 2026
User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection CVE-2026-15281 6.5 Nox Axter August 4, 2026
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action CVE-2026-7456 6.5 Legion Hunter August 4, 2026
TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter CVE-2026-18881 7.5 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Waris Damkham August 4, 2026
Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion CVE-2026-5581 9.1 Riski Gana Prasetya August 4, 2026
Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion CVE-2026-6079 7.3 Md. Moniruzzaman Prodhan (NomanProdhan) August 4, 2026
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting CVE-2026-17532 6.1 Alireza August 4, 2026
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting CVE-2026-17505 6.1 momopon1415 August 4, 2026
LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload CVE-2026-6147 8.8 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777) August 4, 2026
Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API CVE-2026-12000 7.5 Mitchell August 4, 2026
WPFormify <= 1.1.1 - Missing Authorization CVE-2026-6627 8.2 Legion Hunter August 4, 2026
SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-6972 6.4 zaim August 4, 2026
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter CVE-2026-7693 7.2 at1as August 4, 2026
Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2026-5116 4.4 SATYARTH PRAKASH (XoxoL33t) August 4, 2026
Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action CVE-2026-7726 6.5 murd0ck, Patricio Briones (CyberDoomer) August 4, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 13, 2026
Vulns
1 Wordfence PRISM 102
2 Ananda Dhakal 75
3 daroo 23
4 dutafi 10
5 Nabil Irawan 9
6 Legion Hunter 8
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Rafie Muhammad 6
9 Abdullah Kareem "cyberkareem" 6
10 Itthidej Aramsri (Boeing777) 6
11 Que Thanh Tuan 6
12 Phat RiO 6
13 Dmitrii Ignatyev 5
14 hhhai 5
15 luc 5
16 Nguyen Ba Khanh 5
17 Bao - BlueRock 4
18 VanTastic 4
19 Md. Moniruzzaman Prodhan (NomanProdhan) 4
20 Asaf Mozes 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation