WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
5.3
CVE-2026-18436
Jul 30, 2026
Researcher: Jakub Lipiński (A3RES)
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 - Missing Authorization to Unauthenticated Unauthorized Form Submission
5.3
CVE-2026-15054
Jul 30, 2026
Researcher: Charles Vosburgh
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization < 2.6.12 - Missing Authorization
4.3
CVE-2026-15252
Jul 30, 2026
Researcher: LevinityCyber
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 10.0.10 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-14231
Jul 30, 2026
Researcher: Daniel Púa - devploit
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-13145
Jul 30, 2026
Researcher: Revanth Hari Narayana Matte
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-15255
Jul 30, 2026
Researcher: Jonatan Buskila
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 - Missing Authorization
5.3
CVE-2026-14305
Jul 30, 2026
Researcher: Pedro Pinho
Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization
4.3
CVE-2026-14310
Jul 30, 2026
Researcher: Sanjar Tulkinov
Sync Post With Other Site < 1.9.3 - Missing Authorization
4.3
CVE-2026-14923
Jul 30, 2026
Researcher: Shikhali Jamalzade
HBook <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
7.2
CVE-2026-8143
Jul 29, 2026
Researcher: bashu
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
7.2
CVE-2026-15397
Jul 29, 2026
Researcher: Wordfence PRISM
Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
9.8
CVE-2026-16610
Jul 29, 2026
Researcher: Nox Axter
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
7.5
CVE-2026-1360
Jul 29, 2026
Researcher: Vincent Theriault-Laine
FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
8.8
CVE-2026-14356
Jul 29, 2026
Researcher: maru
Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
6.5
CVE-2026-16092
Jul 29, 2026
Researcher: Wordfence PRISM
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
5.3
CVE-2026-1982
Jul 29, 2026
Researcher: Chiao-Lin Yu (Steven Meow)
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure
4.3
CVE-2026-66696
Jul 29, 2026
Researcher: Abdullah Kareem "cyberkareem"
Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 - Unauthenticated Remote Code Execution
9.8
CVE-2026-65553
Jul 29, 2026
Researcher: Ananda Dhakal
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization
4.3
CVE-2026-66699
Jul 29, 2026
Researcher: Ananda Dhakal
Easy Appointments <= 3.12.26 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-14224
Jul 29, 2026
Researcher: Duy Tran
Title CVE ID CVSS Researchers Date
MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint CVE-2026-18436 5.3 Jakub Lipiński (A3RES) July 30, 2026
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 - Missing Authorization to Unauthenticated Unauthorized Form Submission CVE-2026-15054 5.3 Charles Vosburgh July 30, 2026
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization < 2.6.12 - Missing Authorization CVE-2026-15252 4.3 LevinityCyber July 30, 2026
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 10.0.10 - Authenticated (Subscriber+) Information Exposure CVE-2026-14231 4.3 Daniel Púa - devploit July 30, 2026
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-13145 4.3 Revanth Hari Narayana Matte July 30, 2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference CVE-2026-15255 5.3 Jonatan Buskila July 30, 2026
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 - Missing Authorization CVE-2026-14305 5.3 Pedro Pinho July 30, 2026
Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization CVE-2026-14310 4.3 Sanjar Tulkinov July 30, 2026
Sync Post With Other Site < 1.9.3 - Missing Authorization CVE-2026-14923 4.3 Shikhali Jamalzade July 30, 2026
HBook <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters CVE-2026-8143 7.2 bashu July 29, 2026
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action CVE-2026-15397 7.2 Wordfence PRISM July 29, 2026
Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key CVE-2026-16610 9.8 Nox Axter July 29, 2026
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data CVE-2026-1360 7.5 Vincent Theriault-Laine July 29, 2026
FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint CVE-2026-14356 8.8 maru July 29, 2026
Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter CVE-2026-16092 6.5 Wordfence PRISM July 29, 2026
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget CVE-2026-1982 5.3 Chiao-Lin Yu (Steven Meow) July 29, 2026
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure CVE-2026-66696 4.3 Abdullah Kareem "cyberkareem" July 29, 2026
Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 - Unauthenticated Remote Code Execution CVE-2026-65553 9.8 Ananda Dhakal July 29, 2026
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization CVE-2026-66699 4.3 Ananda Dhakal July 29, 2026
Easy Appointments <= 3.12.26 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-14224 4.3 Duy Tran July 29, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 13, 2026
Vulns
1 Wordfence PRISM 102
2 Ananda Dhakal 75
3 daroo 23
4 dutafi 10
5 Nabil Irawan 9
6 Legion Hunter 8
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Rafie Muhammad 6
9 Abdullah Kareem "cyberkareem" 6
10 Itthidej Aramsri (Boeing777) 6
11 Que Thanh Tuan 6
12 Phat RiO 6
13 Dmitrii Ignatyev 5
14 hhhai 5
15 luc 5
16 Nguyen Ba Khanh 5
17 Bao - BlueRock 4
18 VanTastic 4
19 Md. Moniruzzaman Prodhan (NomanProdhan) 4
20 Asaf Mozes 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation