WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
9.8
CVE-2026-4703
Aug 21, 2026
Researcher: Athiwat Tiprasaharn (Jitlada)
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-78470
Aug 21, 2026
Researcher: dutafi
爱采集数据采集和发布插件 <= 1.0.0 - Missing Authorization
5.3
CVE-2026-77013
Aug 21, 2026
Researchers: Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
4.3
CVE-2026-4245
Aug 21, 2026
Researcher: Quốc Huy (jtwings)
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation
7.3
CVE-2026-18776
Aug 21, 2026
Researcher: Abdullah Kareem
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure
5.3
CVE-2026-18778
Aug 21, 2026
Researcher: Luka Zimonjic
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
5.3
CVE-2026-18779
Aug 21, 2026
Researcher: Erwan LR
Broken Link Checker < 2.4.12 - Unauthenticated Remote Code Execution
9.8
CVE-2026-18937
Aug 21, 2026
Researcher: Jakub Herman
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
4.3
CVE-2026-19417
Aug 21, 2026
Researcher: Erwan LR
JetEngine < 3.8.14 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-18202
Aug 21, 2026
Researcher: Erwan LR
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure
4.3
CVE-2026-19699
Aug 21, 2026
Researcher: Shikhali Jamalzade
WooCommerce Bookings <= 3.8.0 - Missing Authorization
4.3
CVE-2026-14853
Aug 21, 2026
Researcher: Mike Gozdiskowski
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal
7.5
CVE-2026-18051
Aug 21, 2026
Researcher: Jakub Herman
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read
7.5
CVE-2026-16616
Aug 21, 2026
Researcher: Sanjar Tulkinov
Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
9.8
CVE-2026-77264
Aug 20, 2026
Researcher: RIA Labs
WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
7.2
CVE-2026-18409
Aug 20, 2026
Researcher: daroo
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Mail Relay
5.3
CVE-2026-18044
Aug 20, 2026
Researcher: Erwan LR
InfiniteWP Client <= 1.13.9 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2026-74011
Aug 20, 2026
Researcher: Ananda Dhakal
Firebase Authentication < 1.7.1 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVE-2026-76793
Aug 20, 2026
Researcher: Abdullah Kareem
WPvivid — Backup, Migration & Staging < 0.9.131 - Unauthenticated Path Traversal
7.5
CVE-2026-19725
Aug 20, 2026
Researcher: Nir Yehoshua
Title CVE ID CVSS Researchers Date
WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission CVE-2026-4703 9.8 Athiwat Tiprasaharn (Jitlada) August 21, 2026
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection CVE-2026-78470 6.5 dutafi August 21, 2026
爱采集数据采集和发布插件 <= 1.0.0 - Missing Authorization CVE-2026-77013 5.3 Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso August 21, 2026
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication CVE-2026-4245 4.3 Quốc Huy (jtwings) August 21, 2026
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation CVE-2026-18776 7.3 Abdullah Kareem August 21, 2026
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure CVE-2026-18778 5.3 Luka Zimonjic August 21, 2026
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization CVE-2026-18779 5.3 Erwan LR August 21, 2026
Broken Link Checker < 2.4.12 - Unauthenticated Remote Code Execution CVE-2026-18937 9.8 Jakub Herman August 21, 2026
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization CVE-2026-19417 4.3 Erwan LR August 21, 2026
JetEngine < 3.8.14 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-18202 6.4 Erwan LR August 21, 2026
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure CVE-2026-19699 4.3 Shikhali Jamalzade August 21, 2026
WooCommerce Bookings <= 3.8.0 - Missing Authorization CVE-2026-14853 4.3 Mike Gozdiskowski August 21, 2026
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal CVE-2026-18051 7.5 Jakub Herman August 21, 2026
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read CVE-2026-16616 7.5 Sanjar Tulkinov August 21, 2026
Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure CVE-2026-77264 9.8 RIA Labs August 20, 2026
WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values CVE-2026-18409 7.2 daroo August 20, 2026
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Mail Relay CVE-2026-18044 5.3 Erwan LR August 20, 2026
InfiniteWP Client <= 1.13.9 - Authenticated (Administrator+) SQL Injection CVE-2026-74011 4.9 Ananda Dhakal August 20, 2026
Firebase Authentication < 1.7.1 - Unauthenticated Privilege Escalation via Account Takeover CVE-2026-76793 9.8 Abdullah Kareem August 20, 2026
WPvivid — Backup, Migration & Staging < 0.9.131 - Unauthenticated Path Traversal CVE-2026-19725 7.5 Nir Yehoshua August 20, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 8, 2026
Vulns
1 Wordfence PRISM 66
2 daroo 46
3 Ananda Dhakal 40
4 Jakub Herman 27
5 Erwan LR 23
6 dutafi 21
7 Asim Alshaya 20
8 Tran Nguyen Bao Khanh 17
9 Shikhali Jamalzade 14
10 Muni Nitish Kumar Yaddala 14
11 Osvaldo Noe Gonzalez Del Rio (Os) 11
12 Sai Praneeth Koti 10
13 Farid Narimanov 10
14 Dmitrii Ignatyev 9
15 Revanth Hari Narayana Matte 9
16 Nabil Irawan 9
17 Pedro Pinho 9
18 Artus KG 7
19 Shivamani Vastrala 7
20 Nir Yehoshua 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation