WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization
4.3
CVE-2026-105064
Oct 5, 2026
Researcher: Ayukiab
Porto Theme - Functionality <= 3.9.3 - Unauthenticated SQL Injection
7.5
CVE-2026-42415
Oct 5, 2026
Researcher: Rafie Muhammad
Memberful – Membership Plugin <= 1.81.2 - Authenticated (Contributor+) Protected Post Content Disclosure
4.3
CVE-2026-104401
Oct 5, 2026
Researcher: sungbyeongchan
Fluent Affiliate Pro <= 1.6.4 - Missing Authorization
5.3
CVE-2026-39789
Oct 5, 2026
Researcher: Ananda Dhakal
WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 - Reflected Cross-Site Scripting
6.1
CVE-2026-39722
Oct 5, 2026
Researcher: João Pedro S Alcântara
Fluent Forms Pro Add On Pack <= 6.2.13 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-94675
Oct 5, 2026
Researcher: Tarcísio Luchesi
Optimole 4.0.0 - 4.2.14 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-96530
Oct 5, 2026
Researcher: Karthik Ramakrishnan
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay
5.3
CVE-2026-105322
Oct 5, 2026
Researcher: Erwan LR
WooCommerce Designer Pro <= 1.9.33 - Authenticated (Subscriber+) Remote Code Execution
8.8
CVE-2026-32568
Oct 4, 2026
Researcher: Nguyen Ba Khanh
Ohio Extra <= 3.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-32571
Oct 4, 2026
Researcher: Nguyen Ba Khanh
Mooberry Book Manager 4.16.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-32581
Oct 4, 2026
Researcher: dodoh4t
Smart Forms – when you need more than just a contact form <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-32574
Oct 4, 2026
Researcher: Nguyen Dinh Hai (HaiND)
Frontend File Manager Plugin <= 23.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-32577
Oct 4, 2026
Researcher: Chamseddine Bouzaiene
SUMO Affiliates Pro <= 11.7.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-32575
Oct 4, 2026
Researcher: dutafi
Faktur Pro for WooCommerce <= 3.2.2 - Authenticated (Customer+) Insecure Direct Object Reference
4.3
CVE-2026-32576
Oct 4, 2026
Researcher: HieuPenguinnn
ECPay Ecommerce for WooCommerce <= 1.1.2606090 - Missing Authorization
4.3
CVE-2026-32578
Oct 4, 2026
Researcher: TRAN THE LONG
Kognetiks Chatbot <= 2.4.9 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-32579
Oct 4, 2026
Researcher: Nguyen Dinh Hai (HaiND)
PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2026-39719
Oct 4, 2026
Researcher: ParkHyunWoo
Progress Planner <= 1.10.0 - Missing Authorization
4.3
CVE-2026-62072
Oct 4, 2026
Researcher: Asim Alshaya
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 - Missing Authorization
5.3
CVE-2026-95526
Oct 4, 2026
Researcher: Sakri Koskimies
Title CVE ID CVSS Researchers Date
Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization CVE-2026-105064 4.3 Ayukiab October 5, 2026
Porto Theme - Functionality <= 3.9.3 - Unauthenticated SQL Injection CVE-2026-42415 7.5 Rafie Muhammad October 5, 2026
Memberful – Membership Plugin <= 1.81.2 - Authenticated (Contributor+) Protected Post Content Disclosure CVE-2026-104401 4.3 sungbyeongchan October 5, 2026
Fluent Affiliate Pro <= 1.6.4 - Missing Authorization CVE-2026-39789 5.3 Ananda Dhakal October 5, 2026
WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 - Reflected Cross-Site Scripting CVE-2026-39722 6.1 João Pedro S Alcântara October 5, 2026
Fluent Forms Pro Add On Pack <= 6.2.13 - Unauthenticated Stored Cross-Site Scripting CVE-2026-94675 7.2 Tarcísio Luchesi October 5, 2026
Optimole 4.0.0 - 4.2.14 - Authenticated (Subscriber+) Information Exposure CVE-2026-96530 4.3 Karthik Ramakrishnan October 5, 2026
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay CVE-2026-105322 5.3 Erwan LR October 5, 2026
WooCommerce Designer Pro <= 1.9.33 - Authenticated (Subscriber+) Remote Code Execution CVE-2026-32568 8.8 Nguyen Ba Khanh October 4, 2026
Ohio Extra <= 3.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-32571 6.4 Nguyen Ba Khanh October 4, 2026
Mooberry Book Manager 4.16.2 - Authenticated (Subscriber+) SQL Injection CVE-2026-32581 6.5 dodoh4t October 4, 2026
Smart Forms – when you need more than just a contact form <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting CVE-2026-32574 7.2 Nguyen Dinh Hai (HaiND) October 4, 2026
Frontend File Manager Plugin <= 23.6 - Unauthenticated Stored Cross-Site Scripting CVE-2026-32577 7.2 Chamseddine Bouzaiene October 4, 2026
SUMO Affiliates Pro <= 11.7.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-32575 7.2 dutafi October 4, 2026
Faktur Pro for WooCommerce <= 3.2.2 - Authenticated (Customer+) Insecure Direct Object Reference CVE-2026-32576 4.3 HieuPenguinnn October 4, 2026
ECPay Ecommerce for WooCommerce <= 1.1.2606090 - Missing Authorization CVE-2026-32578 4.3 TRAN THE LONG October 4, 2026
Kognetiks Chatbot <= 2.4.9 - Unauthenticated Arbitrary File Upload CVE-2026-32579 9.8 Nguyen Dinh Hai (HaiND) October 4, 2026
PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery CVE-2026-39719 7.2 ParkHyunWoo October 4, 2026
Progress Planner <= 1.10.0 - Missing Authorization CVE-2026-62072 4.3 Asim Alshaya October 4, 2026
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 - Missing Authorization CVE-2026-95526 5.3 Sakri Koskimies October 4, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 10, 2026
Vulns
1 Ananda Dhakal 171
2 Wordfence PRISM 68
3 Intrudify 46
4 Artus KG 36
5 Karthik Ramakrishnan 34
6 Jakub Herman 33
7 nh4tvd 32
8 Rafie Muhammad 19
9 daroo 19
10 Francisco José Ramírez Vicente 18
11 JunHee CHO 18
12 Pablo González Pérez 18
13 Iñigo Sánchez Enciso 18
14 neurotx 18
15 Erwan LR 18
16 Peter Tang 16
17 Supakiad S. (m3ez) 16
18 Naoki Kawahigashi 15
19 vuxvinh 15
20 Kuba 15

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation