WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization
4.3
CVE-2026-57740
Jul 6, 2026
Researcher: anhcd05
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Read
7.5
CVE-2025-15662
Jul 6, 2026
Researcher: D01EXPLOIT OFFICIAL
Sina Extension for Elementor <= 3.10.1 - Reflected Cross-Site Scripting
6.1
CVE-2026-14190
Jul 6, 2026
Researcher: Mustafa Ahmed
RT-Theme 18 Responsive WordPress Theme <= 2.5 - Reflected Cross-Site Scripting
6.1
CVE-2026-57745
Jul 6, 2026
Researcher: Bonds
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection
7.5
CVE-2026-57739
Jul 6, 2026
Researcher: kai63001
MemberGlut <= 1.1.4 - Unauthenticated Privilege Escalation
9.8
CVE-2026-12394
Jul 6, 2026
Researcher: moonge
reCAPTCHA for Asgaros Forum <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-57365
Jul 6, 2026
Researcher: HieuPenguinnn
Download Manager <= 3.3.61 - Missing Authorization
4.3
CVE-2026-14235
Jul 6, 2026
Researcher: Alessandro Greco aka Aleff, Giovanbattista Ianni (University of Calabria - UNICAL)
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection
7.5
CVE-2026-57726
Jul 6, 2026
Researcher: daroo
Document Gallery <= 5.1.0 - Reflected Cross-Site Scripting
6.1
CVE-2026-12982
Jul 6, 2026
Researcher: João Ramos Maciel
Masteriyo LMS <= 2.3.0 - Missing Authorization to Unauthenticated User Session Termination
5.3
CVE-2026-13332
Jul 6, 2026
Researcher: Nakata Christian
Contact Form 7 – PayPal & Stripe Add-on <= 2.4 - Open Redirect
5.8
CVE-2026-14236
Jul 6, 2026
Researcher: Pedro Antunes
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.1.3 - Unauthenticated User Enumeration
5.3
CVE-2026-14820
Jul 6, 2026
Researcher: Ahmad Mubarak Alanazi
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration < 4.3.8 - Missing Authorization to Unauthenticated Media Attachment Deletion
5.3
CVE-2026-14568
Jul 6, 2026
Researcher: kimsunghoon
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-13714
Jul 6, 2026
Researcher: Thom Stackhouse
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection
8.1
CVE-2026-57724
Jul 6, 2026
Researcher: VanTastic
The Events Calendar <= 6.16.5.0 - Missing Authorization
5.3
CVE-2026-13390
Jul 6, 2026
Researcher: Haitam Lazaar
BookingPress Pro <= 5.7.2 - Missing Authorization Unauthenticated Information Exposure
6.5
CVE-2026-9830
Jul 6, 2026
Researcher: Kolja Zuelsdorf
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57725
Jul 6, 2026
Researcher: VanTastic
CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor <= 3.0.16 - Cross-Site Request Forgery
4.3
CVE-2026-59520
Jul 5, 2026
Researcher: Ananda Dhakal
Title CVE ID CVSS Researchers Date
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization CVE-2026-57740 4.3 anhcd05 July 6, 2026
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Read CVE-2025-15662 7.5 D01EXPLOIT OFFICIAL July 6, 2026
Sina Extension for Elementor <= 3.10.1 - Reflected Cross-Site Scripting CVE-2026-14190 6.1 Mustafa Ahmed July 6, 2026
RT-Theme 18 Responsive WordPress Theme <= 2.5 - Reflected Cross-Site Scripting CVE-2026-57745 6.1 Bonds July 6, 2026
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection CVE-2026-57739 7.5 kai63001 July 6, 2026
MemberGlut <= 1.1.4 - Unauthenticated Privilege Escalation CVE-2026-12394 9.8 moonge July 6, 2026
reCAPTCHA for Asgaros Forum <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-57365 6.4 HieuPenguinnn July 6, 2026
Download Manager <= 3.3.61 - Missing Authorization CVE-2026-14235 4.3 Alessandro Greco aka Aleff, Giovanbattista Ianni (University of Calabria - UNICAL) July 6, 2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection CVE-2026-57726 7.5 daroo July 6, 2026
Document Gallery <= 5.1.0 - Reflected Cross-Site Scripting CVE-2026-12982 6.1 João Ramos Maciel July 6, 2026
Masteriyo LMS <= 2.3.0 - Missing Authorization to Unauthenticated User Session Termination CVE-2026-13332 5.3 Nakata Christian July 6, 2026
Contact Form 7 – PayPal & Stripe Add-on <= 2.4 - Open Redirect CVE-2026-14236 5.8 Pedro Antunes July 6, 2026
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.1.3 - Unauthenticated User Enumeration CVE-2026-14820 5.3 Ahmad Mubarak Alanazi July 6, 2026
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration < 4.3.8 - Missing Authorization to Unauthenticated Media Attachment Deletion CVE-2026-14568 5.3 kimsunghoon July 6, 2026
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload CVE-2026-13714 9.8 Thom Stackhouse July 6, 2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection CVE-2026-57724 8.1 VanTastic July 6, 2026
The Events Calendar <= 6.16.5.0 - Missing Authorization CVE-2026-13390 5.3 Haitam Lazaar July 6, 2026
BookingPress Pro <= 5.7.2 - Missing Authorization Unauthenticated Information Exposure CVE-2026-9830 6.5 Kolja Zuelsdorf July 6, 2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting CVE-2026-57725 7.2 VanTastic July 6, 2026
CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor <= 3.0.16 - Cross-Site Request Forgery CVE-2026-59520 4.3 Ananda Dhakal July 5, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 13, 2026
Vulns
1 Wordfence PRISM 102
2 Ananda Dhakal 75
3 daroo 23
4 dutafi 10
5 Nabil Irawan 9
6 Legion Hunter 8
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Phat RiO 6
9 Abdullah Kareem "cyberkareem" 6
10 Itthidej Aramsri (Boeing777) 6
11 Que Thanh Tuan 6
12 Rafie Muhammad 6
13 hhhai 5
14 Nguyen Ba Khanh 5
15 luc 5
16 Dmitrii Ignatyev 5
17 Bao - BlueRock 4
18 Supakiad S. (m3ez) 4
19 Mitchell 4
20 Muhammad Yudha - DJ 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation