WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
4.9
CVE-2026-15601
Jul 31, 2026
Researchers: Wordfence PRISM, cuokon
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-15649
Jul 31, 2026
Researcher: Wordfence PRISM
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
5.3
CVE-2026-18059
Jul 31, 2026
Researcher: Win3
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
6.6
CVE-2026-17605
Jul 31, 2026
Researcher: Wordfence PRISM
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
8.1
CVE-2026-15450
Jul 31, 2026
Researcher: Wordfence PRISM
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values
7.2
CVE-2026-15052
Jul 31, 2026
Researcher: she11f
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
8.1
CVE-2026-16144
Jul 31, 2026
Researcher: Wordfence PRISM
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
6.4
CVE-2026-18062
Jul 31, 2026
Researcher: theviper17y
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
6.4
CVE-2026-18435
Jul 31, 2026
Researcher: Wordfence PRISM
Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
6.4
CVE-2026-15662
Jul 31, 2026
Researcher: Wordfence PRISM
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
4.9
CVE-2026-15951
Jul 31, 2026
Researcher: Wordfence PRISM
Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
6.5
CVE-2026-16087
Jul 31, 2026
Researcher: Wordfence PRISM
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()
5.3
CVE-2026-11995
Jul 31, 2026
Researcher: Endang Alfarisi
GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
4.9
CVE-2026-16614
Jul 31, 2026
Researcher: Wordfence PRISM
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
6.4
CVE-2026-16685
Jul 31, 2026
Researcher: Wordfence PRISM
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
6.4
CVE-2026-15950
Jul 31, 2026
Researcher: Wordfence PRISM
GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes
6.4
CVE-2026-13458
Jul 31, 2026
Researcher: Or Benit
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
6.4
CVE-2026-16090
Jul 31, 2026
Researcher: Wordfence PRISM
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
6.4
CVE-2026-16091
Jul 31, 2026
Researcher: Wordfence PRISM
Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method
6.4
CVE-2026-16684
Jul 31, 2026
Researcher: Wordfence PRISM
Title CVE ID CVSS Researchers Date
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) CVE-2026-15601 4.9 Wordfence PRISM, cuokon July 31, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-15649 6.4 Wordfence PRISM July 31, 2026
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation CVE-2026-18059 5.3 Win3 July 31, 2026
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field CVE-2026-17605 6.6 Wordfence PRISM July 31, 2026
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CVE-2026-15450 8.1 Wordfence PRISM July 31, 2026
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values CVE-2026-15052 7.2 she11f July 31, 2026
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter CVE-2026-16144 8.1 Wordfence PRISM July 31, 2026
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content CVE-2026-18062 6.4 theviper17y July 31, 2026
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute CVE-2026-18435 6.4 Wordfence PRISM July 31, 2026
Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter CVE-2026-15662 6.4 Wordfence PRISM July 31, 2026
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter CVE-2026-15951 4.9 Wordfence PRISM July 31, 2026
Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter CVE-2026-16087 6.5 Wordfence PRISM July 31, 2026
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action() CVE-2026-11995 5.3 Endang Alfarisi July 31, 2026
GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter CVE-2026-16614 4.9 Wordfence PRISM July 31, 2026
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute CVE-2026-16685 6.4 Wordfence PRISM July 31, 2026
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute CVE-2026-15950 6.4 Wordfence PRISM July 31, 2026
GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes CVE-2026-13458 6.4 Or Benit July 31, 2026
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode CVE-2026-16090 6.4 Wordfence PRISM July 31, 2026
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode CVE-2026-16091 6.4 Wordfence PRISM July 31, 2026
Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method CVE-2026-16684 6.4 Wordfence PRISM July 31, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 13, 2026
Vulns
1 Wordfence PRISM 102
2 Ananda Dhakal 75
3 daroo 23
4 dutafi 10
5 Nabil Irawan 9
6 Legion Hunter 8
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Rafie Muhammad 6
9 Abdullah Kareem "cyberkareem" 6
10 Itthidej Aramsri (Boeing777) 6
11 Que Thanh Tuan 6
12 Phat RiO 6
13 Dmitrii Ignatyev 5
14 hhhai 5
15 luc 5
16 Nguyen Ba Khanh 5
17 Bao - BlueRock 4
18 VanTastic 4
19 Md. Moniruzzaman Prodhan (NomanProdhan) 4
20 Asaf Mozes 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation