WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
4.3
CVE-2026-13168
Aug 13, 2026
Researcher: Muni Nitish Kumar Yaddala
Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
4.3
CVE-2025-10308
Aug 13, 2026
Researcher: Nabil Irawan
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure
4.3
CVE-2026-13612
Aug 13, 2026
Researcher: Sai Praneeth Koti
Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-28158
Aug 13, 2026
Researcher: luc
Service Finder Booking <= 6.2 - Missing Authorization
4.3
CVE-2026-28159
Aug 13, 2026
Researcher: Jamaal ahmed
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
4.3
CVE-2026-28174
Aug 13, 2026
Researcher: VanTastic
Hydra Booking <= 1.2.2 - Missing Authorization
5.3
CVE-2026-28188
Aug 13, 2026
Researcher: Dave Jong
Mang Board WP <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-61974
Aug 13, 2026
Researcher: etomixer
AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization
4.3
CVE-2026-28181
Aug 13, 2026
Researcher: Asim Alshaya
Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-28170
Aug 13, 2026
Researcher: hivesec
Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-14239
Aug 13, 2026
Researchers:
Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-28156
Aug 13, 2026
Researcher: luc
CubeWP <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-28168
Aug 13, 2026
Researcher: daroo
WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-14922
Aug 13, 2026
Researcher: Sai Praneeth Koti
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-12976
Aug 13, 2026
Researcher: Yaswanth Reddy Sunkara
Travelfic Toolkit <= 1.5.1 - Missing Authorization
4.3
CVE-2026-28186
Aug 13, 2026
Researcher: Asim Alshaya
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
8.1
CVE-2026-28176
Aug 13, 2026
Researcher: Taylsec
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization
5.3
CVE-2026-73401
Aug 13, 2026
Researcher: rajukani100
Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-28187
Aug 13, 2026
Researcher: Coopernicus
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
5.3
CVE-2026-73403
Aug 13, 2026
Researcher: Ziming Zhang
Title CVE ID CVSS Researchers Date
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure CVE-2026-13168 4.3 Muni Nitish Kumar Yaddala August 13, 2026
Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset CVE-2025-10308 4.3 Nabil Irawan August 13, 2026
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure CVE-2026-13612 4.3 Sai Praneeth Koti August 13, 2026
Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting CVE-2026-28158 7.2 luc August 13, 2026
Service Finder Booking <= 6.2 - Missing Authorization CVE-2026-28159 4.3 Jamaal ahmed August 13, 2026
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure CVE-2026-28174 4.3 VanTastic August 13, 2026
Hydra Booking <= 1.2.2 - Missing Authorization CVE-2026-28188 5.3 Dave Jong August 13, 2026
Mang Board WP <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting CVE-2026-61974 7.2 etomixer August 13, 2026
AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization CVE-2026-28181 4.3 Asim Alshaya August 13, 2026
Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting CVE-2026-28170 7.2 hivesec August 13, 2026
Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting CVE-2026-14239 7.2 August 13, 2026
Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection CVE-2026-28156 6.5 luc August 13, 2026
CubeWP <= 1.1.30 - Authenticated (Subscriber+) SQL Injection CVE-2026-28168 6.5 daroo August 13, 2026
WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-14922 6.4 Sai Praneeth Koti August 13, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure CVE-2026-12976 4.3 Yaswanth Reddy Sunkara August 13, 2026
Travelfic Toolkit <= 1.5.1 - Missing Authorization CVE-2026-28186 4.3 Asim Alshaya August 13, 2026
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection CVE-2026-28176 8.1 Taylsec August 13, 2026
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization CVE-2026-73401 5.3 rajukani100 August 13, 2026
Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-28187 7.2 Coopernicus August 13, 2026
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization CVE-2026-73403 5.3 Ziming Zhang August 13, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 16, 2026
Vulns
1 Wordfence PRISM 106
2 Ananda Dhakal 94
3 daroo 36
4 dutafi 16
5 Meher Sudhakar Abbireddi 14
6 Pedro Pinho 12
7 Yaswanth Reddy Sunkara 12
8 Revanth Hari Narayana Matte 10
9 Dmitrii Ignatyev 10
10 Nabil Irawan 10
11 luc 10
12 Bonds 10
13 Jakub Herman 9
14 testoun 9
15 Muni Nitish Kumar Yaddala 9
16 Legion Hunter 9
17 Trương Hữu Phúc (truonghuuphuc) 9
18 Asim Alshaya 9
19 Phat RiO 8
20 Shivamani Vastrala 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation