WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
4.7
CVE-2026-101921
Oct 9, 2026
Researcher: UKO
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
6.5
CVE-2026-96653
Oct 9, 2026
Researcher: Tarcísio Luchesi De Almeida Silva (Poystick)
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
6.4
CVE-2026-103478
Oct 9, 2026
Researcher: Wordfence PRISM
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
9.8
CVE-2026-104803
Oct 9, 2026
Researcher: mamgad
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
5.4
CVE-2026-102291
Oct 9, 2026
Researcher: Jacek Sowiński (dzaku)
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
7.2
CVE-2026-96278
Oct 9, 2026
Researcher: nh4tvd
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
6.4
CVE-2026-96574
Oct 9, 2026
Researcher: Tarcísio Luchesi De Almeida Silva (Poystick)
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
7.2
CVE-2026-96572
Oct 9, 2026
Researcher: theviper17y
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
5.4
CVE-2026-15178
Oct 9, 2026
Researcher: Nadir Şensoy
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
7.2
CVE-2026-12626
Oct 9, 2026
Researcher: Muni Nitish Kumar Yaddala (Stranger825)
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
9.1
CVE-2026-104801
Oct 9, 2026
Researcher: whatm
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
6.4
CVE-2026-6243
Oct 9, 2026
Researcher: Muhammad Yudha - DJ
WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
8.1
CVE-2026-94538
Oct 9, 2026
Researcher: t4g0
Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix
6.1
CVE-2026-5725
Oct 9, 2026
Researcher: Kitch
CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload
5.3
CVE-2026-3717
Oct 9, 2026
Researcher: Teerachai Somprasong
WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
6.5
CVE-2026-107712
Oct 9, 2026
Researcher: Spy0x7
Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
6.1
CVE-2026-89100
Oct 9, 2026
Researcher: Adrien Brunner
Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
7.2
CVE-2026-100161
Oct 9, 2026
Researcher: Adrien Brunner
VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
7.2
CVE-2026-95684
Oct 9, 2026
Researcher: zickzick2
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
7.2
CVE-2026-107742
Oct 9, 2026
Researcher: daroo
Title CVE ID CVSS Researchers Date
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute CVE-2026-101921 4.7 UKO October 9, 2026
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order) CVE-2026-96653 6.5 Tarcísio Luchesi De Almeida Silva (Poystick) October 9, 2026
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter CVE-2026-103478 6.4 Wordfence PRISM October 9, 2026
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback CVE-2026-104803 9.8 mamgad October 9, 2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' CVE-2026-102291 5.4 Jacek Sowiński (dzaku) October 9, 2026
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History CVE-2026-96278 7.2 nh4tvd October 9, 2026
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter CVE-2026-96574 6.4 Tarcísio Luchesi De Almeida Silva (Poystick) October 9, 2026
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE-2026-96572 7.2 theviper17y October 9, 2026
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification CVE-2026-15178 5.4 Nadir Şensoy October 9, 2026
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter CVE-2026-12626 7.2 Muni Nitish Kumar Yaddala (Stranger825) October 9, 2026
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter CVE-2026-104801 9.1 whatm October 9, 2026
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content CVE-2026-6243 6.4 Muhammad Yudha - DJ October 9, 2026
WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions CVE-2026-94538 8.1 t4g0 October 9, 2026
Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix CVE-2026-5725 6.1 Kitch October 9, 2026
CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload CVE-2026-3717 5.3 Teerachai Somprasong October 9, 2026
WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter CVE-2026-107712 6.5 Spy0x7 October 9, 2026
Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment CVE-2026-89100 6.1 Adrien Brunner October 9, 2026
Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter CVE-2026-100161 7.2 Adrien Brunner October 9, 2026
VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter CVE-2026-95684 7.2 zickzick2 October 9, 2026
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE-2026-107742 7.2 daroo October 9, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 13, 2026
Vulns
1 Ananda Dhakal 168
2 Wordfence PRISM 68
3 Intrudify 46
4 Jakub Herman 32
5 Karthik Ramakrishnan 31
6 Artus KG 31
7 nh4tvd 31
8 Rafie Muhammad 19
9 daroo 19
10 Iñigo Sánchez Enciso 18
11 Francisco José Ramírez Vicente 18
12 Pablo González Pérez 18
13 neurotx 18
14 Erwan LR 17
15 Supakiad S. (m3ez) 16
16 JunHee CHO 16
17 Peter Tang 16
18 vuxvinh 15
19 Kuba 15
20 Naoki Kawahigashi 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation