WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
7.5
CVE-2026-77807
Sep 10, 2026
Researcher: daroo
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
6.4
CVE-2026-6641
Sep 10, 2026
Researcher: gidget smith
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
6.4
CVE-2026-6642
Sep 10, 2026
Researcher: TruongLV1 From FPT Night Wolf
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
6.4
CVE-2026-6640
Sep 10, 2026
Researcher: normaandersonfrank
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
6.4
CVE-2026-5399
Sep 9, 2026
Researcher: h0xilo
Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
6.4
CVE-2026-15889
Sep 9, 2026
Researcher: theviper17y
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting
6.1
CVE-2026-85645
Sep 9, 2026
Researcher: braintx
Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field
6.4
CVE-2026-4657
Sep 9, 2026
Researcher: Kitch
Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'
4.3
CVE-2026-18594
Sep 9, 2026
Researcher: Jiang CY
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
4.9
CVE-2026-18386
Sep 9, 2026
Researcher: Nikola Kojic
Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
4.3
CVE-2026-15823
Sep 9, 2026
Researcher: Wordfence PRISM
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
6.4
CVE-2026-15820
Sep 9, 2026
Researcher: Wordfence PRISM
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
6.4
CVE-2026-15796
Sep 9, 2026
Researcher: Wordfence PRISM
Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
7.2
CVE-2026-76562
Sep 9, 2026
Researcher: Nabil Irawan
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
8.0
CVE-2026-14873
Sep 9, 2026
Researchers: Afan, moonge
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
7.5
CVE-2026-15019
Sep 9, 2026
Researcher: Spy0x7
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
9.8
CVE-2026-18351
Sep 9, 2026
Researcher: Adam Rayyan Aryasatya
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
8.8
CVE-2026-80099
Sep 8, 2026
Researcher: sorin vasile
YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
8.8
CVE-2026-14359
Sep 8, 2026
Researcher: Michele Genito
Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
7.2
CVE-2026-14989
Sep 8, 2026
Researcher: Naoya Takahashi (nakko)
Title CVE ID CVSS Researchers Date
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter CVE-2026-77807 7.5 daroo September 10, 2026
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter CVE-2026-6641 6.4 gidget smith September 10, 2026
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import CVE-2026-6642 6.4 TruongLV1 From FPT Night Wolf September 10, 2026
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter CVE-2026-6640 6.4 normaandersonfrank September 10, 2026
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value CVE-2026-5399 6.4 h0xilo September 9, 2026
Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content CVE-2026-15889 6.4 theviper17y September 9, 2026
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting CVE-2026-85645 6.1 braintx September 9, 2026
Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field CVE-2026-4657 6.4 Kitch September 9, 2026
Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id' CVE-2026-18594 4.3 Jiang CY September 9, 2026
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter CVE-2026-18386 4.9 Nikola Kojic September 9, 2026
Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter CVE-2026-15823 4.3 Wordfence PRISM September 9, 2026
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting CVE-2026-15820 6.4 Wordfence PRISM September 9, 2026
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting CVE-2026-15796 6.4 Wordfence PRISM September 9, 2026
Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter CVE-2026-76562 7.2 Nabil Irawan September 9, 2026
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset CVE-2026-14873 8.0 Afan, moonge September 9, 2026
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment CVE-2026-15019 7.5 Spy0x7 September 9, 2026
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter CVE-2026-18351 9.8 Adam Rayyan Aryasatya September 9, 2026
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret CVE-2026-80099 8.8 sorin vasile September 8, 2026
YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user CVE-2026-14359 8.8 Michele Genito September 8, 2026
Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter CVE-2026-14989 7.2 Naoya Takahashi (nakko) September 8, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 12, 2026
Vulns
1 Wordfence PRISM 89
2 Ananda Dhakal 57
3 daroo 52
4 Jakub Herman 38
5 Erwan LR 27
6 dutafi 25
7 Revanth Hari Narayana Matte 21
8 Asim Alshaya 19
9 Shikhali Jamalzade 17
10 Tran Nguyen Bao Khanh 16
11 Sai Praneeth Koti 15
12 Muni Nitish Kumar Yaddala 15
13 Artus KG 13
14 Nabil Irawan 13
15 Osvaldo Noe Gonzalez Del Rio (Os) 12
16 Supakiad S. (m3ez) 11
17 sungbyeongchan 10
18 Shivamani Vastrala 10
19 Dmitrii Ignatyev 9
20 Mohammed Abd Alrahman 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation