WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Accordions – Responsive Accordion & FAQ Plugin for WordPress <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-66471
Aug 10, 2026
Researcher: pajarori
Gift Cards For WooCommerce Pro <= 4.2.9 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-15039
Aug 10, 2026
Researcher: Brandon Steed
Crowdfunding <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure
4.3
CVE-2026-14858
Aug 10, 2026
Researcher: Sajjad Haqi
SureDash – Community, Courses & Member Dashboard <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-66698
Aug 10, 2026
Researcher: Asim Alshaya
Website Internal Link Optimiser <= 5.2.7 - Missing Authorization
5.3
CVE-2026-66464
Aug 10, 2026
Researcher: Legion Hunter
Royal Elementor Addons <= 1.7.1064 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-19217
Aug 10, 2026
Researcher: Dmitrii Ignatyev
User Access Manager <= 2.3.14 - Missing Authorization
5.3
CVE-2026-18035
Aug 10, 2026
Researcher: Farid Narimanov
iCARRY <= 2.9 - Unauthenticated Information Exposure
5.3
CVE-2026-66463
Aug 10, 2026
Researcher: Legion Hunter
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-16977
Aug 10, 2026
Researcher: Revanth Meesala
Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion
9.1
CVE-2026-18048
Aug 10, 2026
Researcher: Erwan LR
WooCommerce Appointments <= 5.3.8 - Unauthenticated Information Exposure
5.3
CVE-2026-66462
Aug 10, 2026
Researcher: adhikara13
Anti Spam and list cleaner – AcyChecker <= 2.0.0 - Missing Authorization
5.3
CVE-2026-66689
Aug 10, 2026
Researcher: vnth4nhnt
WPC Admin Columns <= 2.3.3 - Information Exposure to Authenticated (Subscriber+) Arbitrary User/Post/Term Meta Disclosure
4.3
CVE-2026-18943
Aug 10, 2026
Researcher: Farid Narimanov
ProSolution WP Client <= 2.0.8 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2026-19050
Aug 10, 2026
Researcher: Nir Yehoshua
E-cab Taxi Booking Manager for Woocommerce <= 2.0.3 - Missing Authorization
5.3
CVE-2026-27345
Aug 10, 2026
Researcher: Arif Shaikh
Nokri – Job Board WordPress Theme <= 1.6.6 - Missing Authorization
5.3
CVE-2026-66691
Aug 10, 2026
Researcher: VanTastic
WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection
5.5
CVE ID Unknown
Aug 8, 2026
Researchers:
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass
4.3
CVE ID Unknown
Aug 8, 2026
Researcher: 0ways
WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
5.3
CVE ID Unknown
Aug 8, 2026
Researcher: Elio Gubser (odkdn1)
WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery
5.8
CVE ID Unknown
Aug 8, 2026
Researcher: Andrew MacPherson
Title CVE ID CVSS Researchers Date
Accordions – Responsive Accordion & FAQ Plugin for WordPress <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-66471 6.4 pajarori August 10, 2026
Gift Cards For WooCommerce Pro <= 4.2.9 - Unauthenticated Arbitrary File Upload CVE-2026-15039 9.8 Brandon Steed August 10, 2026
Crowdfunding <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure CVE-2026-14858 4.3 Sajjad Haqi August 10, 2026
SureDash – Community, Courses & Member Dashboard <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-66698 7.2 Asim Alshaya August 10, 2026
Website Internal Link Optimiser <= 5.2.7 - Missing Authorization CVE-2026-66464 5.3 Legion Hunter August 10, 2026
Royal Elementor Addons <= 1.7.1064 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-19217 6.4 Dmitrii Ignatyev August 10, 2026
User Access Manager <= 2.3.14 - Missing Authorization CVE-2026-18035 5.3 Farid Narimanov August 10, 2026
iCARRY <= 2.9 - Unauthenticated Information Exposure CVE-2026-66463 5.3 Legion Hunter August 10, 2026
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection CVE-2026-16977 6.5 Revanth Meesala August 10, 2026
Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion CVE-2026-18048 9.1 Erwan LR August 10, 2026
WooCommerce Appointments <= 5.3.8 - Unauthenticated Information Exposure CVE-2026-66462 5.3 adhikara13 August 10, 2026
Anti Spam and list cleaner – AcyChecker <= 2.0.0 - Missing Authorization CVE-2026-66689 5.3 vnth4nhnt August 10, 2026
WPC Admin Columns <= 2.3.3 - Information Exposure to Authenticated (Subscriber+) Arbitrary User/Post/Term Meta Disclosure CVE-2026-18943 4.3 Farid Narimanov August 10, 2026
ProSolution WP Client <= 2.0.8 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2026-19050 6.4 Nir Yehoshua August 10, 2026
E-cab Taxi Booking Manager for Woocommerce <= 2.0.3 - Missing Authorization CVE-2026-27345 5.3 Arif Shaikh August 10, 2026
Nokri – Job Board WordPress Theme <= 1.6.6 - Missing Authorization CVE-2026-66691 5.3 VanTastic August 10, 2026
WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection 5.5 August 8, 2026
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass 4.3 0ways August 8, 2026
WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds 5.3 Elio Gubser (odkdn1) August 8, 2026
WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery 5.8 Andrew MacPherson August 8, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 10, 2026
Vulns
1 Wordfence PRISM 86
2 daroo 46
3 Ananda Dhakal 39
4 Jakub Herman 25
5 Erwan LR 21
6 dutafi 20
7 Tran Nguyen Bao Khanh 17
8 Asim Alshaya 17
9 Shikhali Jamalzade 14
10 Muni Nitish Kumar Yaddala 13
11 Osvaldo Noe Gonzalez Del Rio (Os) 12
12 Nabil Irawan 12
13 Sai Praneeth Koti 10
14 Revanth Hari Narayana Matte 9
15 Supakiad S. (m3ez) 9
16 Dmitrii Ignatyev 8
17 Shivamani Vastrala 7
18 JunHee CHO 7
19 Meher Sudhakar Abbireddi 7
20 Artus KG 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation