WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
6.4
CVE-2026-17149
Sep 8, 2026
Researcher: Wordfence PRISM
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
4.3
CVE-2026-15398
Sep 8, 2026
Researcher: Wordfence PRISM
WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter
6.5
CVE-2026-19778
Sep 8, 2026
Researcher: Wordfence PRISM
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
7.2
CVE-2026-75927
Sep 8, 2026
Researcher: Wordfence PRISM
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
4.3
CVE-2026-19802
Sep 8, 2026
Researcher: Nabil Irawan
WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
5.3
CVE ID Unknown
Sep 8, 2026
Researcher: Wordfence PRISM
Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
8.1
CVE-2026-76009
Sep 8, 2026
Researcher: Samuele Santonicola
ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
4.3
CVE-2026-8615
Sep 8, 2026
Researcher: Legion Hunter
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
5.3
CVE-2026-84908
Sep 8, 2026
Researcher: Wordfence PRISM
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
4.3
CVE-2026-19946
Sep 8, 2026
Researcher: Wordfence PRISM
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
7.2
CVE-2026-83593
Sep 8, 2026
Researcher: Ivaylo
WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode
4.3
CVE-2026-75905
Sep 8, 2026
Researcher: Wordfence PRISM
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
5.4
CVE-2026-11821
Sep 8, 2026
Researcher: Sushi Com Abacate
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
6.4
CVE-2026-19945
Sep 8, 2026
Researcher: Wordfence PRISM
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
4.9
CVE-2026-19944
Sep 8, 2026
Researcher: Wordfence PRISM
User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
6.1
CVE-2026-19797
Sep 8, 2026
Researcher: Wordfence PRISM
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
7.2
CVE-2026-17553
Sep 8, 2026
Researcher: Wordfence PRISM
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
6.1
CVE-2026-7804
Sep 8, 2026
Researcher: Yuto Hyakumoto
Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
6.4
CVE-2026-75966
Sep 8, 2026
Researcher: Wordfence PRISM
Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter
4.9
CVE-2026-19800
Sep 8, 2026
Researcher: Wordfence PRISM
Title CVE ID CVSS Researchers Date
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute CVE-2026-17149 6.4 Wordfence PRISM September 8, 2026
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption CVE-2026-15398 4.3 Wordfence PRISM September 8, 2026
WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter CVE-2026-19778 6.5 Wordfence PRISM September 8, 2026
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant CVE-2026-75927 7.2 Wordfence PRISM September 8, 2026
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter CVE-2026-19802 4.3 Nabil Irawan September 8, 2026
WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters 5.3 Wordfence PRISM September 8, 2026
Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint CVE-2026-76009 8.1 Samuele Santonicola September 8, 2026
ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function CVE-2026-8615 4.3 Legion Hunter September 8, 2026
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action CVE-2026-84908 5.3 Wordfence PRISM September 8, 2026
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter CVE-2026-19946 4.3 Wordfence PRISM September 8, 2026
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter CVE-2026-83593 7.2 Ivaylo September 8, 2026
WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode CVE-2026-75905 4.3 Wordfence PRISM September 8, 2026
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint CVE-2026-11821 5.4 Sushi Com Abacate September 8, 2026
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-19945 6.4 Wordfence PRISM September 8, 2026
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta CVE-2026-19944 4.9 Wordfence PRISM September 8, 2026
User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter CVE-2026-19797 6.1 Wordfence PRISM September 8, 2026
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action CVE-2026-17553 7.2 Wordfence PRISM September 8, 2026
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter CVE-2026-7804 6.1 Yuto Hyakumoto September 8, 2026
Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter CVE-2026-75966 6.4 Wordfence PRISM September 8, 2026
Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter CVE-2026-19800 4.9 Wordfence PRISM September 8, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 12, 2026
Vulns
1 Wordfence PRISM 89
2 Ananda Dhakal 57
3 daroo 52
4 Jakub Herman 38
5 Erwan LR 27
6 dutafi 25
7 Revanth Hari Narayana Matte 21
8 Asim Alshaya 19
9 Shikhali Jamalzade 17
10 Tran Nguyen Bao Khanh 16
11 Sai Praneeth Koti 15
12 Muni Nitish Kumar Yaddala 15
13 Artus KG 13
14 Nabil Irawan 13
15 Osvaldo Noe Gonzalez Del Rio (Os) 12
16 Supakiad S. (m3ez) 11
17 sungbyeongchan 10
18 Shivamani Vastrala 10
19 Dmitrii Ignatyev 9
20 Mohammed Abd Alrahman 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation