WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-5391
Aug 5, 2026
Researcher: alex_henry20
PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
6.4
CVE-2026-5158
Aug 5, 2026
Researcher: Muhammad Yudha - DJ
TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVE-2026-18510
Aug 5, 2026
Researcher: Pham Duc Anh
Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting
6.4
CVE-2026-18400
Aug 5, 2026
Researcher: haofanjiukunle
WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
8.1
CVE-2026-15459
Aug 5, 2026
Researcher: Austin Ginder
FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
7.2
CVE-2026-16636
Aug 5, 2026
Researcher: Fraudless
File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
8.8
CVE-2026-15991
Aug 5, 2026
Researcher: daroo
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
7.2
CVE-2026-18325
Aug 5, 2026
Researcher: daroo
Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
4.7
CVE-2026-15452
Aug 4, 2026
Researcher: Tarcísio Luchesi De Almeida Silva (Poystick)
Easy Post Submission <= 2.3.0 - Missing Authorization
9.1
CVE-2026-4431
Aug 4, 2026
Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)
WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection
6.5
CVE-2026-11977
Aug 4, 2026
Researcher: Ryoma Nishioka
WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2026-11969
Aug 4, 2026
Researcher: yuyudhn
JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
4.9
CVE-2026-11920
Aug 4, 2026
Researcher: Nicolas Decayeux
MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action
8.1
CVE-2026-7520
Aug 4, 2026
Researcher: t0ann9uy3n
Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal
7.5
CVE ID Unknown
Aug 4, 2026
Researcher: KEVIN LEE (crattack)
ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
7.2
CVE-2026-6020
Aug 4, 2026
Researchers: Itthidej Aramsri (Boeing777), Waris Damkham, Teerachai Somprasong
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
6.5
CVE-2026-11454
Aug 4, 2026
Researcher: Lucius-log
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
4.3
CVE-2026-7105
Aug 4, 2026
Researcher: normaandersonfrank
User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-15281
Aug 4, 2026
Researcher: Nox Axter
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
6.5
CVE-2026-7456
Aug 4, 2026
Researcher: Legion Hunter
Title CVE ID CVSS Researchers Date
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-5391 6.4 alex_henry20 August 5, 2026
PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block CVE-2026-5158 6.4 Muhammad Yudha - DJ August 5, 2026
TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-18510 7.2 Pham Duc Anh August 5, 2026
Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting CVE-2026-18400 6.4 haofanjiukunle August 5, 2026
WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint CVE-2026-15459 8.1 Austin Ginder August 5, 2026
FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs CVE-2026-16636 7.2 Fraudless August 5, 2026
File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter CVE-2026-15991 8.8 daroo August 5, 2026
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field CVE-2026-18325 7.2 daroo August 5, 2026
Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String CVE-2026-15452 4.7 Tarcísio Luchesi De Almeida Silva (Poystick) August 4, 2026
Easy Post Submission <= 2.3.0 - Missing Authorization CVE-2026-4431 9.1 Md. Moniruzzaman Prodhan (NomanProdhan) August 4, 2026
WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection CVE-2026-11977 6.5 Ryoma Nishioka August 4, 2026
WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection CVE-2026-11969 4.9 yuyudhn August 4, 2026
JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter CVE-2026-11920 4.9 Nicolas Decayeux August 4, 2026
MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action CVE-2026-7520 8.1 t0ann9uy3n August 4, 2026
Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal 7.5 KEVIN LEE (crattack) August 4, 2026
ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API CVE-2026-6020 7.2 Itthidej Aramsri (Boeing777), Waris Damkham, Teerachai Somprasong August 4, 2026
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference CVE-2026-11454 6.5 Lucius-log August 4, 2026
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function CVE-2026-7105 4.3 normaandersonfrank August 4, 2026
User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection CVE-2026-15281 6.5 Nox Axter August 4, 2026
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action CVE-2026-7456 6.5 Legion Hunter August 4, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 9, 2026
Vulns
1 Wordfence PRISM 110
2 Ananda Dhakal 78
3 daroo 27
4 dutafi 11
5 Nabil Irawan 10
6 Legion Hunter 9
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Nguyen Ba Khanh 7
9 Abdullah Kareem "cyberkareem" 6
10 Phat RiO 6
11 Supakiad S. (m3ez) 6
12 zaim 6
13 Itthidej Aramsri (Boeing777) 6
14 Que Thanh Tuan 6
15 Dmitrii Ignatyev 6
16 h0xilo 5
17 Rafie Muhammad 5
18 hhhai 5
19 luc 5
20 Kazuma Matsumoto 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation