WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery
8.1
CVE-2026-7444
Aug 4, 2026
Researchers: nudien udin, nudien
Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-7441
Aug 4, 2026
Researcher: zaim
Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter
4.9
CVE-2026-5651
Aug 4, 2026
Researcher: Régis SENET
Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
4.4
CVE-2026-5108
Aug 4, 2026
Researcher: lucsob
AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure
7.5
CVE-2026-6639
Aug 4, 2026
Researcher: Kazuma Matsumoto
wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
7.5
CVE-2026-7529
Aug 4, 2026
Researcher: Legion Hunter
Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
6.5
CVE-2026-7753
Aug 4, 2026
Researcher: momopon1415
PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter
4.9
CVE-2026-5062
Aug 4, 2026
Researcher: Michael Iden (Mickhat)
Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
8.1
CVE-2026-15979
Aug 4, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)
Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-15941
Aug 4, 2026
Researcher: daroo
Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
6.1
CVE-2026-8790
Aug 4, 2026
Researcher: whitesector
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
6.5
CVE-2026-11421
Aug 4, 2026
Researcher: Hyunsoo Jeong
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
9.3
CVE-2026-9273
Aug 4, 2026
Researcher: scort
Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation
8.8
CVE-2026-8761
Aug 4, 2026
Researcher: kai63001
Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-17506
Aug 4, 2026
Researcher: daroo
VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-16143
Aug 4, 2026
Researcher: nthng
VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
7.5
CVE-2026-15918
Aug 4, 2026
Researcher: nthng
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
8.8
CVE-2026-18322
Aug 4, 2026
Researcher: daroo
Remote API <= 0.2 - Unauthenticated PHP Object Injection
8.1
CVE-2026-14602
Aug 3, 2026
Researcher: Pedro Pinho
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
7.5
CVE-2026-13395
Aug 3, 2026
Researcher: Jakub Herman
Title CVE ID CVSS Researchers Date
Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery CVE-2026-7444 8.1 nudien udin, nudien August 4, 2026
Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-7441 6.4 zaim August 4, 2026
Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter CVE-2026-5651 4.9 Régis SENET August 4, 2026
Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting CVE-2026-5108 4.4 lucsob August 4, 2026
AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVE-2026-6639 7.5 Kazuma Matsumoto August 4, 2026
wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API CVE-2026-7529 7.5 Legion Hunter August 4, 2026
Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2026-7753 6.5 momopon1415 August 4, 2026
PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter CVE-2026-5062 4.9 Michael Iden (Mickhat) August 4, 2026
Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion CVE-2026-15979 8.1 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777) August 4, 2026
Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection CVE-2026-15941 6.5 daroo August 4, 2026
Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting CVE-2026-8790 6.1 whitesector August 4, 2026
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter CVE-2026-11421 6.5 Hyunsoo Jeong August 4, 2026
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover CVE-2026-9273 9.3 scort August 4, 2026
Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation CVE-2026-8761 8.8 kai63001 August 4, 2026
Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-17506 7.2 daroo August 4, 2026
VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-16143 7.2 nthng August 4, 2026
VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection CVE-2026-15918 7.5 nthng August 4, 2026
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator CVE-2026-18322 8.8 daroo August 4, 2026
Remote API <= 0.2 - Unauthenticated PHP Object Injection CVE-2026-14602 8.1 Pedro Pinho August 3, 2026
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection CVE-2026-13395 7.5 Jakub Herman August 3, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 13, 2026
Vulns
1 Wordfence PRISM 102
2 Ananda Dhakal 75
3 daroo 23
4 dutafi 10
5 Nabil Irawan 9
6 Legion Hunter 8
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Rafie Muhammad 6
9 Abdullah Kareem "cyberkareem" 6
10 Itthidej Aramsri (Boeing777) 6
11 Que Thanh Tuan 6
12 Phat RiO 6
13 Dmitrii Ignatyev 5
14 hhhai 5
15 luc 5
16 Nguyen Ba Khanh 5
17 Bao - BlueRock 4
18 VanTastic 4
19 Md. Moniruzzaman Prodhan (NomanProdhan) 4
20 Asaf Mozes 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation