WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Relevanssi Light <= 1.2.2 - Unauthenticated SQL Injection
7.5
CVE-2026-59533
Jul 23, 2026
Researcher: ParkHyunWoo
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2026-65516
Jul 23, 2026
Researcher: longnv719
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.2 - Missing Authorization
4.3
CVE-2026-65530
Jul 23, 2026
Researcher: Ananda Dhakal
WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass
4.3
CVE-2026-59546
Jul 23, 2026
Researcher: Ananda Dhakal
Appointment Hour Booking – Booking Calendar <= 1.5.86 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-65514
Jul 23, 2026
Researcher: Ananda Dhakal
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2026-59537
Jul 23, 2026
Researcher: Ananda Dhakal
Graphina – Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization
5.3
CVE-2026-65529
Jul 23, 2026
Researcher: Ananda Dhakal
WP Activity Log <= 5.6.4 - Cross-Site Request Forgery
4.3
CVE-2026-65512
Jul 23, 2026
Researcher: Levon Balyan
Byteflows Travel & Hotel Booking <= 1.0.0 - Unauthenticated Information Exposure
5.3
CVE-2026-59548
Jul 23, 2026
Researcher: Ananda Dhakal
BSK PDF Manager <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-65528
Jul 23, 2026
Researcher: luc
LIQUID SPEECH BALLOON <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-65527
Jul 23, 2026
Researcher: Ananda Dhakal
Civi Framework <= 2.2.0 - Missing Authorization
5.3
CVE-2026-65525
Jul 23, 2026
Researcher: Tran Nguyen Bao Khanh
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-59551
Jul 23, 2026
Researcher: Abdullah Kareem "cyberkareem"
Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVE-2026-65493
Jul 23, 2026
Researcher: Expatch
Ebook Store <= 6.19 - Unauthenticated Information Exposure
5.3
CVE-2026-59529
Jul 23, 2026
Researcher: hivesec
AWP Classifieds <= 4.4.7 - Unauthenticated SQL Injection
7.5
CVE-2026-59550
Jul 23, 2026
Researcher: Thaer Assfour
Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
4.3
CVE-2026-65540
Jul 23, 2026
Researcher: testoun
Custom links in Elementor Image Carousel <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-65534
Jul 23, 2026
Researcher: Ananda Dhakal
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Unauthenticated SQL Injection
7.5
CVE-2026-59549
Jul 23, 2026
Researcher: Zainul Anwar Adi Putra
MapSVG <= 8.14.0 - Unauthenticated SQL Injection
7.5
CVE-2026-59526
Jul 23, 2026
Researcher: Trương Hữu Phúc (truonghuuphuc)
Title CVE ID CVSS Researchers Date
Relevanssi Light <= 1.2.2 - Unauthenticated SQL Injection CVE-2026-59533 7.5 ParkHyunWoo July 23, 2026
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery CVE-2026-65516 7.2 longnv719 July 23, 2026
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.2 - Missing Authorization CVE-2026-65530 4.3 Ananda Dhakal July 23, 2026
WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass CVE-2026-59546 4.3 Ananda Dhakal July 23, 2026
Appointment Hour Booking – Booking Calendar <= 1.5.86 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-65514 6.4 Ananda Dhakal July 23, 2026
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection CVE-2026-59537 4.9 Ananda Dhakal July 23, 2026
Graphina – Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization CVE-2026-65529 5.3 Ananda Dhakal July 23, 2026
WP Activity Log <= 5.6.4 - Cross-Site Request Forgery CVE-2026-65512 4.3 Levon Balyan July 23, 2026
Byteflows Travel & Hotel Booking <= 1.0.0 - Unauthenticated Information Exposure CVE-2026-59548 5.3 Ananda Dhakal July 23, 2026
BSK PDF Manager <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-65528 6.4 luc July 23, 2026
LIQUID SPEECH BALLOON <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-65527 6.4 Ananda Dhakal July 23, 2026
Civi Framework <= 2.2.0 - Missing Authorization CVE-2026-65525 5.3 Tran Nguyen Bao Khanh July 23, 2026
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Authenticated (Subscriber+) SQL Injection CVE-2026-59551 6.5 Abdullah Kareem "cyberkareem" July 23, 2026
Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) PHP Object Injection CVE-2026-65493 7.5 Expatch July 23, 2026
Ebook Store <= 6.19 - Unauthenticated Information Exposure CVE-2026-59529 5.3 hivesec July 23, 2026
AWP Classifieds <= 4.4.7 - Unauthenticated SQL Injection CVE-2026-59550 7.5 Thaer Assfour July 23, 2026
Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery CVE-2026-65540 4.3 testoun July 23, 2026
Custom links in Elementor Image Carousel <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-65534 6.4 Ananda Dhakal July 23, 2026
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Unauthenticated SQL Injection CVE-2026-59549 7.5 Zainul Anwar Adi Putra July 23, 2026
MapSVG <= 8.14.0 - Unauthenticated SQL Injection CVE-2026-59526 7.5 Trương Hữu Phúc (truonghuuphuc) July 23, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 9, 2026
Vulns
1 Wordfence PRISM 110
2 Ananda Dhakal 78
3 daroo 27
4 dutafi 11
5 Nabil Irawan 10
6 Legion Hunter 9
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Nguyen Ba Khanh 7
9 Abdullah Kareem "cyberkareem" 6
10 Phat RiO 6
11 Supakiad S. (m3ez) 6
12 zaim 6
13 Itthidej Aramsri (Boeing777) 6
14 Que Thanh Tuan 6
15 Dmitrii Ignatyev 6
16 h0xilo 5
17 Rafie Muhammad 5
18 hhhai 5
19 luc 5
20 Kazuma Matsumoto 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation