WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter
6.4
CVE-2026-17090
Aug 14, 2026
Researcher: a1batr0ss
Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter
6.5
CVE-2026-16080
Aug 14, 2026
Researcher: Wordfence PRISM
Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
5.3
CVE-2026-12128
Aug 14, 2026
Researchers: Enrico Marcolini, Claudio Marchesini (Dottormarc)
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
5.3
CVE-2026-8840
Aug 14, 2026
Researcher: Raihan Adi Arba
Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
8.8
CVE-2026-15312
Aug 14, 2026
Researcher: Wordfence PRISM
Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection
7.5
CVE-2026-15162
Aug 14, 2026
Researcher: nthng
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
7.2
CVE-2026-14433
Aug 14, 2026
Researcher: MatilJ
MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter
8.8
CVE-2026-15965
Aug 14, 2026
Researcher: JIWOONG LEE (kimchunbok)
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
9.8
CVE-2026-15341
Aug 14, 2026
Researchers: Afan, moonge
6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter
9.8
CVE-2026-15303
Aug 14, 2026
Researchers: Afan, moonge
bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
8.8
CVE-2026-15001
Aug 14, 2026
Researcher: CHOIGYEONGMIN
RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
9.1
CVE-2026-14484
Aug 14, 2026
Researcher: Spy0x7
Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter
4.9
CVE-2026-16094
Aug 14, 2026
Researcher: Wordfence PRISM
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause
5.3
CVE-2026-15993
Aug 14, 2026
Researcher: R4mbb
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
7.2
CVE-2026-13360
Aug 14, 2026
Researcher: Naoya Takahashi (nakko)
WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter
6.5
CVE-2026-12248
Aug 14, 2026
Researcher: momopon1415
Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
9.8
CVE-2026-12949
Aug 13, 2026
Researcher: bashu
Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter
6.5
CVE-2026-16810
Aug 13, 2026
Researcher: Wordfence PRISM
affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
4.9
CVE-2026-12743
Aug 13, 2026
Researcher: Wordfence PRISM
W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
7.2
CVE-2026-18109
Aug 13, 2026
Researcher: daroo
Title CVE ID CVSS Researchers Date
Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter CVE-2026-17090 6.4 a1batr0ss August 14, 2026
Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter CVE-2026-16080 6.5 Wordfence PRISM August 14, 2026
Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter CVE-2026-12128 5.3 Enrico Marcolini, Claudio Marchesini (Dottormarc) August 14, 2026
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action CVE-2026-8840 5.3 Raihan Adi Arba August 14, 2026
Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter CVE-2026-15312 8.8 Wordfence PRISM August 14, 2026
Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection CVE-2026-15162 7.5 nthng August 14, 2026
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter CVE-2026-14433 7.2 MatilJ August 14, 2026
MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter CVE-2026-15965 8.8 JIWOONG LEE (kimchunbok) August 14, 2026
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters CVE-2026-15341 9.8 Afan, moonge August 14, 2026
6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter CVE-2026-15303 9.8 Afan, moonge August 14, 2026
bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings CVE-2026-15001 8.8 CHOIGYEONGMIN August 14, 2026
RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters CVE-2026-14484 9.1 Spy0x7 August 14, 2026
Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter CVE-2026-16094 4.9 Wordfence PRISM August 14, 2026
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause CVE-2026-15993 5.3 R4mbb August 14, 2026
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter CVE-2026-13360 7.2 Naoya Takahashi (nakko) August 14, 2026
WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter CVE-2026-12248 6.5 momopon1415 August 14, 2026
Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter CVE-2026-12949 9.8 bashu August 13, 2026
Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter CVE-2026-16810 6.5 Wordfence PRISM August 13, 2026
affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CVE-2026-12743 4.9 Wordfence PRISM August 13, 2026
W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE-2026-18109 7.2 daroo August 13, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 16, 2026
Vulns
1 Wordfence PRISM 106
2 Ananda Dhakal 94
3 daroo 36
4 dutafi 16
5 Meher Sudhakar Abbireddi 14
6 Pedro Pinho 12
7 Yaswanth Reddy Sunkara 12
8 Revanth Hari Narayana Matte 10
9 Dmitrii Ignatyev 10
10 Nabil Irawan 10
11 luc 10
12 Bonds 10
13 Jakub Herman 9
14 testoun 9
15 Muni Nitish Kumar Yaddala 9
16 Legion Hunter 9
17 Trương Hữu Phúc (truonghuuphuc) 9
18 Asim Alshaya 9
19 Phat RiO 8
20 Shivamani Vastrala 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation