WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.2.2 - Authenticated (Shop manager+) SQL Injection
4.9
CVE-2026-65532
Jul 23, 2026
Researcher: Ananda Dhakal
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization
5.3
CVE-2026-59530
Jul 23, 2026
Researcher: timomangcut
Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-65494
Jul 23, 2026
Researcher: Expatch
Cyr to Lat Reloaded – Transliteration of Links and File Names <= 1.3.3 - Missing Authorization
4.3
CVE-2026-65537
Jul 23, 2026
Researcher: Ananda Dhakal
Smart SEO Tool – SEO优化插件 <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-65533
Jul 23, 2026
Researcher: Ananda Dhakal
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری <= 4.4.5 - Cross-Site Request Forgery
4.3
CVE-2026-65536
Jul 23, 2026
Researcher: Ananda Dhakal
Kwayy HTML Sitemap <= 4.0 - Cross-Site Request Forgery
4.3
CVE-2026-65539
Jul 23, 2026
Researcher: Ananda Dhakal
CoCart – Headless REST API for WooCommerce <= 4.8.4 - Missing Authorization
5.3
CVE-2026-59536
Jul 23, 2026
Researcher: VanTastic
WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets <= 4.3.0 - Unauthenticated Information Exposure
5.3
CVE-2026-65521
Jul 23, 2026
Researcher: Ananda Dhakal
Accept Donations with PayPal & Stripe <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-65518
Jul 23, 2026
Researcher: Ananda Dhakal
Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Missing Authorization
5.3
CVE-2026-65500
Jul 23, 2026
Researcher: ed32.dll
Avada Custom Branding <= 1.2 - Missing Authorization
4.3
CVE-2026-65524
Jul 23, 2026
Researcher: Bonds
Post My CF7 Form <= 6.2.0 - Missing Authorization
5.3
CVE-2026-59534
Jul 23, 2026
Researcher: Mitchell
Qubely – Advanced Gutenberg Blocks <= 1.8.14 - Missing Authorization
5.3
CVE-2026-65531
Jul 23, 2026
Researcher: Ananda Dhakal
ShipTime: Discount Shipping <= 1.1.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-59528
Jul 23, 2026
Researcher: VuNBT
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-65510
Jul 23, 2026
Researcher: hhhai
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection
7.5
CVE-2026-59538
Jul 23, 2026
Researcher: qdtad
Falcon – WordPress Optimizations & Tweaks <= 2.10.0 - Missing Authorization
5.3
CVE-2026-59531
Jul 23, 2026
Researcher: dodoh4t
Machete <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-65538
Jul 23, 2026
Researcher: Ananda Dhakal
3D Flipbook PDF Viewer & Embedder <= 1.4.2 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2026-59552
Jul 23, 2026
Researcher: Nabil Irawan
Title CVE ID CVSS Researchers Date
افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.2.2 - Authenticated (Shop manager+) SQL Injection CVE-2026-65532 4.9 Ananda Dhakal July 23, 2026
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization CVE-2026-59530 5.3 timomangcut July 23, 2026
Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) SQL Injection CVE-2026-65494 6.5 Expatch July 23, 2026
Cyr to Lat Reloaded – Transliteration of Links and File Names <= 1.3.3 - Missing Authorization CVE-2026-65537 4.3 Ananda Dhakal July 23, 2026
Smart SEO Tool – SEO优化插件 <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-65533 6.4 Ananda Dhakal July 23, 2026
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری <= 4.4.5 - Cross-Site Request Forgery CVE-2026-65536 4.3 Ananda Dhakal July 23, 2026
Kwayy HTML Sitemap <= 4.0 - Cross-Site Request Forgery CVE-2026-65539 4.3 Ananda Dhakal July 23, 2026
CoCart – Headless REST API for WooCommerce <= 4.8.4 - Missing Authorization CVE-2026-59536 5.3 VanTastic July 23, 2026
WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets <= 4.3.0 - Unauthenticated Information Exposure CVE-2026-65521 5.3 Ananda Dhakal July 23, 2026
Accept Donations with PayPal & Stripe <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-65518 6.4 Ananda Dhakal July 23, 2026
Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Missing Authorization CVE-2026-65500 5.3 ed32.dll July 23, 2026
Avada Custom Branding <= 1.2 - Missing Authorization CVE-2026-65524 4.3 Bonds July 23, 2026
Post My CF7 Form <= 6.2.0 - Missing Authorization CVE-2026-59534 5.3 Mitchell July 23, 2026
Qubely – Advanced Gutenberg Blocks <= 1.8.14 - Missing Authorization CVE-2026-65531 5.3 Ananda Dhakal July 23, 2026
ShipTime: Discount Shipping <= 1.1.1 - Authenticated (Subscriber+) Information Exposure CVE-2026-59528 4.3 VuNBT July 23, 2026
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting CVE-2026-65510 7.2 hhhai July 23, 2026
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection CVE-2026-59538 7.5 qdtad July 23, 2026
Falcon – WordPress Optimizations & Tweaks <= 2.10.0 - Missing Authorization CVE-2026-59531 5.3 dodoh4t July 23, 2026
Machete <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-65538 6.4 Ananda Dhakal July 23, 2026
3D Flipbook PDF Viewer & Embedder <= 1.4.2 - Unauthenticated Server-Side Request Forgery CVE-2026-59552 7.2 Nabil Irawan July 23, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 9, 2026
Vulns
1 Wordfence PRISM 110
2 Ananda Dhakal 78
3 daroo 27
4 dutafi 11
5 Nabil Irawan 10
6 Legion Hunter 9
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Nguyen Ba Khanh 7
9 Abdullah Kareem "cyberkareem" 6
10 Phat RiO 6
11 Supakiad S. (m3ez) 6
12 zaim 6
13 Itthidej Aramsri (Boeing777) 6
14 Que Thanh Tuan 6
15 Dmitrii Ignatyev 6
16 h0xilo 5
17 Rafie Muhammad 5
18 hhhai 5
19 luc 5
20 Kazuma Matsumoto 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation