WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.12 - Unauthenticated SQL Injection
7.5
CVE-2026-66472
Aug 10, 2026
Researcher: Manopakorn Kooharueangrong (manop55555)
TeraWallet - Wallet for WooCommerce <= 1.6.9 - Missing Authorization to Authenticated (Subscriber+) Wallet Balance Inflation
4.3
CVE-2026-16538
Aug 10, 2026
Researcher: Guillermo Álvarez Fernández
Smart Online Order for Clover <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-66700
Aug 10, 2026
Researcher: Asim Alshaya
Directory Kit <= 1.5.5 - Unauthenticated SQL Injection
7.5
CVE-2026-18474
Aug 10, 2026
Researcher: Pedro Pinho
Salon Booking System <= 10.30.19 - Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass
4.3
CVE-2026-11887
Aug 10, 2026
Researcher: Kevin
Photo Album Plus <= 9.2.09.1 - Missing Authorization
4.3
CVE-2026-18962
Aug 10, 2026
Researcher: Farid Narimanov
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation
5.3
CVE-2026-13171
Aug 10, 2026
Researcher: Sanjorn Keeratirungsan
Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting
6.1
CVE-2026-17013
Aug 10, 2026
Researcher: Muni Nitish Kumar Yaddala
Church Admin <= 5.1.1 - Unauthenticated SQL Injection
7.5
CVE-2026-66478
Aug 10, 2026
Researcher: Zainul Anwar Adi Putra
Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification
5.3
CVE-2026-16737
Aug 10, 2026
Researcher: Usama Arshad
WP Umbrella: Security Backup Restore & Monitoring 2.24.2-2.26.2 - Cross-Site Request Forgery
4.3
CVE-2026-66642
Aug 10, 2026
Researcher: Anthony Green of Greenhat Security
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.1.1 - Missing Authorization
5.3
CVE-2026-66466
Aug 10, 2026
Researcher: Vincent Sevkli
Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
4.3
CVE-2026-11880
Aug 10, 2026
Researcher: Pedro Pinho
Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-66444
Aug 10, 2026
Researcher: Muhan Luo
Gutenverse Companion <= 2.5.1 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2026-66704
Aug 10, 2026
Researcher: Ananda Dhakal
ProSolution WP Client <= 2.0.8 - Missing Authorization
4.3
CVE-2026-19052
Aug 10, 2026
Researcher: Nir Yehoshua
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.7.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-66467
Aug 10, 2026
Researcher: Septio Noerdiansyah
Colissimo shipping methods for WooCommerce <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-66697
Aug 10, 2026
Researcher: Asim Alshaya
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.3.2 - Authenticated (Customer+) Stored Cross-Site Scripting
6.4
CVE-2026-66687
Aug 10, 2026
Researcher: V1T
Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-18230
Aug 10, 2026
Researcher: Erwan LR
Title CVE ID CVSS Researchers Date
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.12 - Unauthenticated SQL Injection CVE-2026-66472 7.5 Manopakorn Kooharueangrong (manop55555) August 10, 2026
TeraWallet - Wallet for WooCommerce <= 1.6.9 - Missing Authorization to Authenticated (Subscriber+) Wallet Balance Inflation CVE-2026-16538 4.3 Guillermo Álvarez Fernández August 10, 2026
Smart Online Order for Clover <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-66700 7.2 Asim Alshaya August 10, 2026
Directory Kit <= 1.5.5 - Unauthenticated SQL Injection CVE-2026-18474 7.5 Pedro Pinho August 10, 2026
Salon Booking System <= 10.30.19 - Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass CVE-2026-11887 4.3 Kevin August 10, 2026
Photo Album Plus <= 9.2.09.1 - Missing Authorization CVE-2026-18962 4.3 Farid Narimanov August 10, 2026
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation CVE-2026-13171 5.3 Sanjorn Keeratirungsan August 10, 2026
Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting CVE-2026-17013 6.1 Muni Nitish Kumar Yaddala August 10, 2026
Church Admin <= 5.1.1 - Unauthenticated SQL Injection CVE-2026-66478 7.5 Zainul Anwar Adi Putra August 10, 2026
Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification CVE-2026-16737 5.3 Usama Arshad August 10, 2026
WP Umbrella: Security Backup Restore & Monitoring 2.24.2-2.26.2 - Cross-Site Request Forgery CVE-2026-66642 4.3 Anthony Green of Greenhat Security August 10, 2026
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.1.1 - Missing Authorization CVE-2026-66466 5.3 Vincent Sevkli August 10, 2026
Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation CVE-2026-11880 4.3 Pedro Pinho August 10, 2026
Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure CVE-2026-66444 4.3 Muhan Luo August 10, 2026
Gutenverse Companion <= 2.5.1 - Unauthenticated Server-Side Request Forgery CVE-2026-66704 7.2 Ananda Dhakal August 10, 2026
ProSolution WP Client <= 2.0.8 - Missing Authorization CVE-2026-19052 4.3 Nir Yehoshua August 10, 2026
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.7.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-66467 6.4 Septio Noerdiansyah August 10, 2026
Colissimo shipping methods for WooCommerce <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-66697 7.2 Asim Alshaya August 10, 2026
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.3.2 - Authenticated (Customer+) Stored Cross-Site Scripting CVE-2026-66687 6.4 V1T August 10, 2026
Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection CVE-2026-18230 6.5 Erwan LR August 10, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 10, 2026
Vulns
1 Wordfence PRISM 86
2 daroo 46
3 Ananda Dhakal 39
4 Jakub Herman 25
5 Erwan LR 21
6 dutafi 20
7 Tran Nguyen Bao Khanh 17
8 Asim Alshaya 17
9 Shikhali Jamalzade 14
10 Muni Nitish Kumar Yaddala 13
11 Osvaldo Noe Gonzalez Del Rio (Os) 12
12 Nabil Irawan 12
13 Sai Praneeth Koti 10
14 Revanth Hari Narayana Matte 9
15 Supakiad S. (m3ez) 9
16 Dmitrii Ignatyev 8
17 Shivamani Vastrala 7
18 JunHee CHO 7
19 Meher Sudhakar Abbireddi 7
20 Artus KG 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation