WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
6.4
CVE-2026-102402
Oct 9, 2026
Researcher: Wordfence PRISM
Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
7.2
CVE-2026-96840
Oct 9, 2026
Researcher: Jacek Sowiński (dzaku)
SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
3.7
CVE-2026-104006
Oct 9, 2026
Researcher: Kuba
SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
6.5
CVE-2026-97348
Oct 9, 2026
Researcher: Wordfence PRISM
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
6.4
CVE-2026-103427
Oct 9, 2026
Researcher: Maciej Komorowski
LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVE-2026-100196
Oct 9, 2026
Researcher: theviper17y
Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
4.4
CVE-2026-103897
Oct 9, 2026
Researcher: Jakub Herman
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
7.2
CVE-2026-96558
Oct 9, 2026
Researcher: Kuba
Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
7.2
CVE-2026-96682
Oct 9, 2026
Researcher: 20kilograma
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
4.9
CVE-2026-104763
Oct 9, 2026
Researcher: Wordfence PRISM
Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
4.9
CVE-2026-104023
Oct 9, 2026
Researcher: Wordfence PRISM
Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
7.2
CVE-2026-93775
Oct 9, 2026
Researcher: Ivaylo
Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
5.3
CVE-2026-94375
Oct 9, 2026
Researcher: Boluwatife Opeyemi (tcyph3r)
Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
5.4
CVE-2026-103482
Oct 9, 2026
Researcher: crow
Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
7.5
CVE ID Unknown
Oct 9, 2026
Researcher: Quentin VILLAIN
MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-16776
Oct 9, 2026
Researcher: Wordfence PRISM
LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
8.8
CVE-2026-104723
Oct 9, 2026
Researcher: Wordfence PRISM
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
8.8
CVE-2026-104766
Oct 9, 2026
Researcher: Wordfence PRISM
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
4.3
CVE-2026-91050
Oct 9, 2026
Researcher: Supakiad S. (m3ez)
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
6.4
CVE-2026-104762
Oct 9, 2026
Researcher: Wordfence PRISM
Title CVE ID CVSS Researchers Date
Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode CVE-2026-102402 6.4 Wordfence PRISM October 9, 2026
Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field CVE-2026-96840 7.2 Jacek Sowiński (dzaku) October 9, 2026
SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check CVE-2026-104006 3.7 Kuba October 9, 2026
SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable) CVE-2026-97348 6.5 Wordfence PRISM October 9, 2026
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field CVE-2026-103427 6.4 Maciej Komorowski October 9, 2026
LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-100196 7.2 theviper17y October 9, 2026
Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute CVE-2026-103897 4.4 Jakub Herman October 9, 2026
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter CVE-2026-96558 7.2 Kuba October 9, 2026
Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag CVE-2026-96682 7.2 20kilograma October 9, 2026
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json CVE-2026-104763 4.9 Wordfence PRISM October 9, 2026
Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter CVE-2026-104023 4.9 Wordfence PRISM October 9, 2026
Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook CVE-2026-93775 7.2 Ivaylo October 9, 2026
Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path() CVE-2026-94375 5.3 Boluwatife Opeyemi (tcyph3r) October 9, 2026
Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot CVE-2026-103482 5.4 crow October 9, 2026
Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter 7.5 Quentin VILLAIN October 9, 2026
MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-16776 6.4 Wordfence PRISM October 9, 2026
LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data CVE-2026-104723 8.8 Wordfence PRISM October 9, 2026
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter CVE-2026-104766 8.8 Wordfence PRISM October 9, 2026
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter CVE-2026-91050 4.3 Supakiad S. (m3ez) October 9, 2026
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute CVE-2026-104762 6.4 Wordfence PRISM October 9, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 13, 2026
Vulns
1 Ananda Dhakal 168
2 Wordfence PRISM 68
3 Intrudify 46
4 Jakub Herman 32
5 Karthik Ramakrishnan 31
6 Artus KG 31
7 nh4tvd 31
8 Rafie Muhammad 19
9 daroo 19
10 Iñigo Sánchez Enciso 18
11 Francisco José Ramírez Vicente 18
12 Pablo González Pérez 18
13 neurotx 18
14 Erwan LR 17
15 Supakiad S. (m3ez) 16
16 JunHee CHO 16
17 Peter Tang 16
18 vuxvinh 15
19 Kuba 15
20 Naoki Kawahigashi 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation