WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVE-2026-87920
Oct 1, 2026
Researcher: theviper17y
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
6.1
CVE-2026-97652
Oct 1, 2026
Researcher: Jakub Herman
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
6.1
CVE-2026-85492
Oct 1, 2026
Researcher: mak3bread
Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
7.2
CVE-2026-103426
Oct 1, 2026
Researcher: Philipp Doblhofer
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVE-2026-97641
Oct 1, 2026
Researcher: Yuto Hyakumoto
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
3.1
CVE-2026-102002
Oct 1, 2026
Researcher: Jakub Herman
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
7.2
CVE-2026-96566
Oct 1, 2026
Researcher: crow
MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
7.2
CVE-2026-96567
Oct 1, 2026
Researcher: Kuba
No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect
7.2
CVE-2026-95670
Oct 1, 2026
Researcher: Afifudin Maarif
Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
7.2
CVE-2026-96871
Oct 1, 2026
Researcher: John Ryan Albon
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter
6.4
CVE-2026-96647
Oct 1, 2026
Researcher: Theklis
Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
5.3
CVE-2026-94432
Oct 1, 2026
Researchers: Niv Kochan, Matan Bachar
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
7.2
CVE-2026-100107
Oct 1, 2026
Researcher: daroo
JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
9.8
CVE-2026-97637
Oct 1, 2026
Researcher: Chi Trung Huynh
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
7.2
CVE-2026-97342
Oct 1, 2026
Researcher: UKO
GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVE-2026-96578
Oct 1, 2026
Researcher: theviper17y
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
7.2
CVE-2026-93756
Oct 1, 2026
Researcher: Yuto Hyakumoto
Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
6.1
CVE-2026-93880
Oct 1, 2026
Researcher: Jiemook
Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
6.5
CVE-2026-97634
Oct 1, 2026
Researcher: Wordfence PRISM
Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
7.2
CVE-2026-100182
Oct 1, 2026
Researcher: whale120
Title CVE ID CVSS Researchers Date
W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-87920 7.2 theviper17y October 1, 2026
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key CVE-2026-97652 6.1 Jakub Herman October 1, 2026
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname CVE-2026-85492 6.1 mak3bread October 1, 2026
Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter CVE-2026-103426 7.2 Philipp Doblhofer October 1, 2026
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-97641 7.2 Yuto Hyakumoto October 1, 2026
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget CVE-2026-102002 3.1 Jakub Herman October 1, 2026
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter CVE-2026-96566 7.2 crow October 1, 2026
MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta) CVE-2026-96567 7.2 Kuba October 1, 2026
No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect CVE-2026-95670 7.2 Afifudin Maarif October 1, 2026
Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter CVE-2026-96871 7.2 John Ryan Albon October 1, 2026
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter CVE-2026-96647 6.4 Theklis October 1, 2026
Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter CVE-2026-94432 5.3 Niv Kochan, Matan Bachar October 1, 2026
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass) CVE-2026-100107 7.2 daroo October 1, 2026
JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response CVE-2026-97637 9.8 Chi Trung Huynh October 1, 2026
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action CVE-2026-97342 7.2 UKO October 1, 2026
GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-96578 7.2 theviper17y October 1, 2026
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview CVE-2026-93756 7.2 Yuto Hyakumoto October 1, 2026
Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder CVE-2026-93880 6.1 Jiemook October 1, 2026
Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter CVE-2026-97634 6.5 Wordfence PRISM October 1, 2026
Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor CVE-2026-100182 7.2 whale120 October 1, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 9, 2026
Vulns
1 Ananda Dhakal 148
2 Wordfence PRISM 42
3 Intrudify 41
4 Artus KG 34
5 Karthik Ramakrishnan 34
6 Jakub Herman 31
7 nh4tvd 24
8 daroo 19
9 Iñigo Sánchez Enciso 18
10 Francisco José Ramírez Vicente 18
11 Pablo González Pérez 18
12 JunHee CHO 16
13 Erwan LR 15
14 Usama Arshad 15
15 Pedro Pinho 14
16 Kuba 14
17 Naoki Kawahigashi 14
18 vuxvinh 13
19 Dmitrii Ignatyev 13
20 Charles Vosburgh 13

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation