WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
YITH WooCommerce Wishlist < 4.18.1 - Missing Authorization
5.3
CVE-2026-82305
Sep 11, 2026
Researcher: Abdullah Kareem
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.0 - 5.0.15 - Authenticated (Custom Role+) Privilege Escalation
6.3
CVE-2026-74925
Sep 11, 2026
Researcher: Philipp Doblhofer
Bold Page Builder <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-62110
Sep 11, 2026
Researcher: LevinityCyber
Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
5.3
CVE-2026-17585
Sep 11, 2026
Researcher: TarPeg007
CoolClock < 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-83545
Sep 11, 2026
Researcher: Philipp Doblhofer
SSL Zen — SSL Certificate Installer & HTTPS Redirects < 4.7.40 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-86781
Sep 11, 2026
Researcher: Suhayb Ahmed
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
6.4
CVE-2026-10148
Sep 11, 2026
Researcher: Nguyen Anh Quan (prototw)
Simple Payment <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-62111
Sep 11, 2026
Researcher: V1T
Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-82213
Sep 11, 2026
Researcher: Ryan Fabella
ElasticPress <= 5.3.4 - Unauthenticated Information Exposure
5.3
CVE-2026-62088
Sep 11, 2026
Researcher: murloc.mrglwglwgl
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization
5.3
CVE-2026-78361
Sep 11, 2026
Researcher: Naoki Kawahigashi
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated <= 4.10.0 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2026-62113
Sep 11, 2026
Researcher: Sybre Waaijer
Gato GraphQL <= 19.2.3 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVE-2026-62102
Sep 11, 2026
Researcher: benzdeus
Visualizer – Tables & Charts Manager with Built-in AI Generator 4.0.0 - 4.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2026-86782
Sep 11, 2026
Researcher: Artus KG
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
4.3
CVE-2024-12145
Sep 10, 2026
Researcher: Brian Mungai
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
7.2
CVE-2026-17037
Sep 10, 2026
Researcher: daroo
Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization
5.3
CVE-2026-11446
Sep 10, 2026
Researcher: revblock
HUSKY <= 1.4.3 - Reflected Cross-Site Scripting
6.1
CVE-2026-18562
Sep 10, 2026
Researcher: Kuba
Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
6.1
CVE-2026-77150
Sep 10, 2026
Researcher: Kuba
WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
6.1
CVE-2026-84960
Sep 10, 2026
Researcher: Kuba
Title CVE ID CVSS Researchers Date
YITH WooCommerce Wishlist < 4.18.1 - Missing Authorization CVE-2026-82305 5.3 Abdullah Kareem September 11, 2026
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.0 - 5.0.15 - Authenticated (Custom Role+) Privilege Escalation CVE-2026-74925 6.3 Philipp Doblhofer September 11, 2026
Bold Page Builder <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-62110 6.4 LevinityCyber September 11, 2026
Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter CVE-2026-17585 5.3 TarPeg007 September 11, 2026
CoolClock < 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-83545 6.4 Philipp Doblhofer September 11, 2026
SSL Zen — SSL Certificate Installer & HTTPS Redirects < 4.7.40 - Authenticated (Subscriber+) Information Exposure CVE-2026-86781 4.3 Suhayb Ahmed September 11, 2026
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter CVE-2026-10148 6.4 Nguyen Anh Quan (prototw) September 11, 2026
Simple Payment <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-62111 6.4 V1T September 11, 2026
Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Insecure Direct Object Reference CVE-2026-82213 5.3 Ryan Fabella September 11, 2026
ElasticPress <= 5.3.4 - Unauthenticated Information Exposure CVE-2026-62088 5.3 murloc.mrglwglwgl September 11, 2026
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization CVE-2026-78361 5.3 Naoki Kawahigashi September 11, 2026
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated <= 4.10.0 - Authenticated (Contributor+) Insecure Direct Object Reference CVE-2026-62113 4.3 Sybre Waaijer September 11, 2026
Gato GraphQL <= 19.2.3 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-62102 6.3 benzdeus September 11, 2026
Visualizer – Tables & Charts Manager with Built-in AI Generator 4.0.0 - 4.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference CVE-2026-86782 4.3 Artus KG September 11, 2026
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion CVE-2024-12145 4.3 Brian Mungai September 10, 2026
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter CVE-2026-17037 7.2 daroo September 10, 2026
Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization CVE-2026-11446 5.3 revblock September 10, 2026
HUSKY <= 1.4.3 - Reflected Cross-Site Scripting CVE-2026-18562 6.1 Kuba September 10, 2026
Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting CVE-2026-77150 6.1 Kuba September 10, 2026
WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting CVE-2026-84960 6.1 Kuba September 10, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 17, 2026
Vulns
1 Wordfence PRISM 64
2 Ananda Dhakal 56
3 daroo 43
4 Jakub Herman 36
5 dutafi 25
6 Erwan LR 24
7 Artus KG 19
8 Revanth Hari Narayana Matte 19
9 Shikhali Jamalzade 17
10 Tran Nguyen Bao Khanh 14
11 Asim Alshaya 13
12 Sai Praneeth Koti 13
13 sungbyeongchan 12
14 Osvaldo Noe Gonzalez Del Rio (Os) 12
15 Usama Arshad 10
16 JunHee CHO 10
17 Supakiad S. (m3ez) (m3ez) 9
18 Abdullah Kareem 9
19 Mohammed Abd Alrahman 9
20 Nabil Irawan 9

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation