WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint
9.8
CVE-2026-15015
Jul 22, 2026
Researcher: AeonRisk
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
9.8
CVE-2026-14282
Jul 22, 2026
Researcher: CHOIGYEONGMIN
Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
9.8
CVE-2026-15011
Jul 22, 2026
Researcher: theviper17y
WP BASE Booking of Appointments, Services and Events <= 6.3.1 - Authenticated (Subscriber+) Privilege Escalation
9.8
CVE-2026-59541
Jul 22, 2026
Researcher: Afan
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation
9.8
CVE-2026-59540
Jul 22, 2026
Researcher: Taylsec
Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
9.8
CVE-2026-13439
Jul 20, 2026
Researcher: CHOIGYEONGMIN
Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation
9.8
CVE-2026-14561
Jul 20, 2026
Researcher: 0xBassia
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
9.8
CVE-2026-63030
Jul 17, 2026
Researcher: Adam Kues
TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation
9.8
CVE-2026-61951
Jul 17, 2026
Researcher: yangsori
Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
9.8
CVE-2026-14956
Jul 16, 2026
Researcher: 0xd4rk5id3
SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
9.8
CVE-2026-15013
Jul 15, 2026
Researcher: lhking
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
9.8
CVE-2026-13001
Jul 14, 2026
Researcher: Talal Nasraddeen
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
9.8
CVE-2026-15982
Jul 13, 2026
Researcher: Bao Le
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
9.8
CVE-2026-12761
Jul 10, 2026
Researcher: Supakiad S. (m3ez)
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
9.8
CVE-2026-14894
Jul 9, 2026
Researcher: andrea bocchetti
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.3 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-57719
Jul 9, 2026
Researcher: 0xd4rk5id3
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.77.3 - Unauthenticated Privilege Escalation
9.8
CVE-2026-57813
Jul 9, 2026
Researcher: qdtad
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Remote Code Execution
9.8
CVE-2026-57811
Jul 9, 2026
Researcher: ParkHyunWoo
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter
9.8
CVE-2026-14245
Jul 8, 2026
Researcher: Khaled Alenazi (Nxploited)
Streamit <= 4.5.0 - Unauthenticated Remote Code Execution
9.8
CVE-2026-13423
Jul 8, 2026
Researcher: Erwan LR
Title CVE ID CVSS Researchers Date
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint CVE-2026-15015 9.8 AeonRisk July 22, 2026
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field CVE-2026-14282 9.8 CHOIGYEONGMIN July 22, 2026
Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter CVE-2026-15011 9.8 theviper17y July 22, 2026
WP BASE Booking of Appointments, Services and Events <= 6.3.1 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-59541 9.8 Afan July 22, 2026
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation CVE-2026-59540 9.8 Taylsec July 22, 2026
Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint CVE-2026-13439 9.8 CHOIGYEONGMIN July 20, 2026
Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation CVE-2026-14561 9.8 0xBassia July 20, 2026
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion CVE-2026-63030 9.8 Adam Kues July 17, 2026
TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation CVE-2026-61951 9.8 yangsori July 17, 2026
Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter CVE-2026-14956 9.8 0xd4rk5id3 July 16, 2026
SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion CVE-2026-15013 9.8 lhking July 15, 2026
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter CVE-2026-13001 9.8 Talal Nasraddeen July 14, 2026
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function' CVE-2026-15982 9.8 Bao Le July 13, 2026
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow CVE-2026-12761 9.8 Supakiad S. (m3ez) July 10, 2026
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) CVE-2026-14894 9.8 andrea bocchetti July 9, 2026
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.3 - Unauthenticated Arbitrary File Upload CVE-2026-57719 9.8 0xd4rk5id3 July 9, 2026
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.77.3 - Unauthenticated Privilege Escalation CVE-2026-57813 9.8 qdtad July 9, 2026
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Remote Code Execution CVE-2026-57811 9.8 ParkHyunWoo July 9, 2026
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter CVE-2026-14245 9.8 Khaled Alenazi (Nxploited) July 8, 2026
Streamit <= 4.5.0 - Unauthenticated Remote Code Execution CVE-2026-13423 9.8 Erwan LR July 8, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 10, 2026
Vulns
1 Ananda Dhakal 171
2 Wordfence PRISM 68
3 Intrudify 46
4 Artus KG 36
5 Karthik Ramakrishnan 34
6 Jakub Herman 33
7 nh4tvd 32
8 Rafie Muhammad 19
9 daroo 19
10 Francisco José Ramírez Vicente 18
11 JunHee CHO 18
12 Pablo González Pérez 18
13 Iñigo Sánchez Enciso 18
14 neurotx 18
15 Erwan LR 18
16 Peter Tang 16
17 Supakiad S. (m3ez) 16
18 Naoki Kawahigashi 15
19 vuxvinh 15
20 Kuba 15

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation