WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
ShopLentor Pro <= 2.8.5 - Missing Authorization
4.3
CVE-2026-61973
Aug 1, 2026
Researcher: Ananda Dhakal
ShopLentor Pro <= 2.8.5 - Missing Authorization
5.3
CVE-2026-61972
Aug 1, 2026
Researcher: Ananda Dhakal
JetReviews <= 3.0.1 - Unauthenticated Information Exposure
5.3
CVE-2026-61975
Aug 1, 2026
Researcher: Ananda Dhakal
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
8.8
CVE-2026-16635
Jul 31, 2026
Researchers: Afan, moonge
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
9.8
CVE-2026-15964
Jul 31, 2026
Researcher: andrea bocchetti
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
6.5
CVE-2026-6453
Jul 31, 2026
Researchers: Louis Deschanel (JeanJeanLeHaxor), Pascal SUN
Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
6.1
CVE-2026-18344
Jul 31, 2026
Researcher: Wordfence PRISM
WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
5.3
CVE-2025-14073
Jul 31, 2026
Researcher: Drew Webber (mcdruid)
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
6.4
CVE-2026-15644
Jul 31, 2026
Researcher: Wordfence PRISM
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
6.1
CVE-2026-17571
Jul 31, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
4.9
CVE-2026-17555
Jul 31, 2026
Researcher: Wordfence PRISM
RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action
4.3
CVE-2026-10782
Jul 31, 2026
Researcher: dyingman
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
4.9
CVE-2026-15601
Jul 31, 2026
Researchers: Wordfence PRISM, cuokon
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-15649
Jul 31, 2026
Researcher: Wordfence PRISM
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
5.3
CVE-2026-18059
Jul 31, 2026
Researcher: Win3
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
6.6
CVE-2026-17605
Jul 31, 2026
Researcher: Wordfence PRISM
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
8.1
CVE-2026-15450
Jul 31, 2026
Researcher: Wordfence PRISM
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values
7.2
CVE-2026-15052
Jul 31, 2026
Researcher: she11f
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
8.1
CVE-2026-16144
Jul 31, 2026
Researcher: Wordfence PRISM
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
6.4
CVE-2026-18062
Jul 31, 2026
Researcher: theviper17y
Title CVE ID CVSS Researchers Date
ShopLentor Pro <= 2.8.5 - Missing Authorization CVE-2026-61973 4.3 Ananda Dhakal August 1, 2026
ShopLentor Pro <= 2.8.5 - Missing Authorization CVE-2026-61972 5.3 Ananda Dhakal August 1, 2026
JetReviews <= 3.0.1 - Unauthenticated Information Exposure CVE-2026-61975 5.3 Ananda Dhakal August 1, 2026
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field CVE-2026-16635 8.8 Afan, moonge July 31, 2026
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change CVE-2026-15964 9.8 andrea bocchetti July 31, 2026
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter CVE-2026-6453 6.5 Louis Deschanel (JeanJeanLeHaxor), Pascal SUN July 31, 2026
Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter CVE-2026-18344 6.1 Wordfence PRISM July 31, 2026
WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure CVE-2025-14073 5.3 Drew Webber (mcdruid) July 31, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute CVE-2026-15644 6.4 Wordfence PRISM July 31, 2026
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' CVE-2026-17571 6.1 Osvaldo Noe Gonzalez Del Rio (Os) July 31, 2026
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter CVE-2026-17555 4.9 Wordfence PRISM July 31, 2026
RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action CVE-2026-10782 4.3 dyingman July 31, 2026
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) CVE-2026-15601 4.9 Wordfence PRISM, cuokon July 31, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-15649 6.4 Wordfence PRISM July 31, 2026
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation CVE-2026-18059 5.3 Win3 July 31, 2026
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field CVE-2026-17605 6.6 Wordfence PRISM July 31, 2026
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CVE-2026-15450 8.1 Wordfence PRISM July 31, 2026
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values CVE-2026-15052 7.2 she11f July 31, 2026
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter CVE-2026-16144 8.1 Wordfence PRISM July 31, 2026
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content CVE-2026-18062 6.4 theviper17y July 31, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 9, 2026
Vulns
1 Wordfence PRISM 110
2 Ananda Dhakal 78
3 daroo 27
4 dutafi 11
5 Nabil Irawan 10
6 Legion Hunter 9
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Nguyen Ba Khanh 7
9 Abdullah Kareem "cyberkareem" 6
10 Phat RiO 6
11 Supakiad S. (m3ez) 6
12 zaim 6
13 Itthidej Aramsri (Boeing777) 6
14 Que Thanh Tuan 6
15 Dmitrii Ignatyev 6
16 h0xilo 5
17 Rafie Muhammad 5
18 hhhai 5
19 luc 5
20 Kazuma Matsumoto 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation