WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection
9.8
CVE-2024-13784
Aug 15, 2026
Researcher: Krzysztof Zając
Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint
7.2
CVE-2026-10734
Aug 15, 2026
Researcher: Denny Abraham Sinaga (dennyabrahamsinaga)
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
4.3
CVE-2026-18347
Aug 15, 2026
Researcher: Datist Pham
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
7.2
CVE-2026-13424
Aug 15, 2026
Researcher: Dmitrii Ignatyev
Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
4.9
CVE-2026-17604
Aug 15, 2026
Researcher: Wordfence PRISM
Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys
7.2
CVE-2026-2497
Aug 15, 2026
Researcher: Farrukh Ziyaev
Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter
5.3
CVE-2026-12998
Aug 15, 2026
Researcher: se1en
WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter
7.5
CVE-2026-17087
Aug 15, 2026
Researcher: Supakiad S. (m3ez)
WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
6.5
CVE-2026-17608
Aug 15, 2026
Researcher: Wordfence PRISM
WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine
7.2
CVE-2026-17581
Aug 15, 2026
Researcher: Wordfence PRISM
WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
4.9
CVE-2026-15351
Aug 15, 2026
Researcher: Wordfence PRISM
Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode
6.4
CVE-2026-15790
Aug 15, 2026
Researcher: Wordfence PRISM
User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter
4.9
CVE-2026-2283
Aug 15, 2026
Researcher: Nikola Kojic
Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection
6.6
CVE-2026-10035
Aug 15, 2026
Researcher: Luk6785
Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta
6.4
CVE-2026-15604
Aug 15, 2026
Researcher: Wordfence PRISM
The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter
6.5
CVE-2026-9767
Aug 15, 2026
Researcher: j4ck13ch4n
SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute
6.4
CVE-2026-18402
Aug 15, 2026
Researcher: Wordfence PRISM
Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-16758
Aug 15, 2026
Researcher: Wordfence PRISM
Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
6.4
CVE-2026-16775
Aug 15, 2026
Researcher: Wordfence PRISM
Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)
4.9
CVE-2026-17582
Aug 15, 2026
Researcher: Wordfence PRISM
Title CVE ID CVSS Researchers Date
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection CVE-2024-13784 9.8 Krzysztof Zając August 15, 2026
Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint CVE-2026-10734 7.2 Denny Abraham Sinaga (dennyabrahamsinaga) August 15, 2026
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter CVE-2026-18347 4.3 Datist Pham August 15, 2026
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action CVE-2026-13424 7.2 Dmitrii Ignatyev August 15, 2026
Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter CVE-2026-17604 4.9 Wordfence PRISM August 15, 2026
Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys CVE-2026-2497 7.2 Farrukh Ziyaev August 15, 2026
Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter CVE-2026-12998 5.3 se1en August 15, 2026
WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter CVE-2026-17087 7.5 Supakiad S. (m3ez) August 15, 2026
WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion CVE-2026-17608 6.5 Wordfence PRISM August 15, 2026
WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine CVE-2026-17581 7.2 Wordfence PRISM August 15, 2026
WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter CVE-2026-15351 4.9 Wordfence PRISM August 15, 2026
Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode CVE-2026-15790 6.4 Wordfence PRISM August 15, 2026
User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter CVE-2026-2283 4.9 Nikola Kojic August 15, 2026
Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection CVE-2026-10035 6.6 Luk6785 August 15, 2026
Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta CVE-2026-15604 6.4 Wordfence PRISM August 15, 2026
The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter CVE-2026-9767 6.5 j4ck13ch4n August 15, 2026
SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute CVE-2026-18402 6.4 Wordfence PRISM August 15, 2026
Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-16758 6.4 Wordfence PRISM August 15, 2026
Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute CVE-2026-16775 6.4 Wordfence PRISM August 15, 2026
Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) CVE-2026-17582 4.9 Wordfence PRISM August 15, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 17, 2026
Vulns
1 Wordfence PRISM 106
2 Ananda Dhakal 94
3 daroo 36
4 dutafi 16
5 Meher Sudhakar Abbireddi 13
6 Pedro Pinho 12
7 Yaswanth Reddy Sunkara 12
8 luc 10
9 Bonds 10
10 Nabil Irawan 10
11 Dmitrii Ignatyev 10
12 Revanth Hari Narayana Matte 10
13 testoun 9
14 Trương Hữu Phúc (truonghuuphuc) 9
15 Muni Nitish Kumar Yaddala 9
16 Legion Hunter 9
17 Jakub Herman 9
18 Asim Alshaya 9
19 Shivamani Vastrala 8
20 Phat RiO 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation