WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
4.8
CVE-2026-100159
Oct 15, 2026
Researcher: YC_Infosec
Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
4.3
CVE-2026-108092
Oct 14, 2026
Researcher: Kazuma Matsumoto
Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
4.3
CVE-2026-11905
Oct 14, 2026
Researcher: Or Benit
Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
7.2
CVE-2026-88043
Oct 14, 2026
Researcher: John Ryan Albon
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
6.5
CVE-2026-86803
Oct 14, 2026
Researcher: hashiramasenju333
VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
6.4
CVE-2026-78087
Oct 14, 2026
Researcher: theviper17y
Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
6.4
CVE-2026-78001
Oct 14, 2026
Researcher: Omar Elshopky (3l5h0pky)
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
7.2
CVE-2026-18586
Oct 14, 2026
Researcher: thevietronin
Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
7.2
CVE-2026-18548
Oct 14, 2026
Researcher: thevietronin
Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
6.1
CVE-2026-18557
Oct 14, 2026
Researcher: Dmitrii Ignatyev
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
6.4
CVE-2026-17001
Oct 14, 2026
Researcher: Luca Laytynher (LyT)
Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
8.1
CVE-2026-17031
Oct 14, 2026
Researcher: @nacento
Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
6.1
CVE-2026-15180
Oct 14, 2026
Researcher: Suredsi Ulpada (cyberdesu)
Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter
7.5
CVE-2026-15090
Oct 14, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
6.4
CVE-2026-14572
Oct 14, 2026
Researcher: Pham Duc Anh
PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
7.3
CVE-2026-3712
Oct 14, 2026
Researcher: Itthidej Aramsri (Boeing777)
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
9.8
CVE-2026-108587
Oct 14, 2026
Researcher: Osman Hussein
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
8.8
CVE-2026-86461
Oct 14, 2026
Researcher: Osman Hussein
Trust Payments Gateway for WooCommerce < 3.1.0 - Missing Authorization
5.3
CVE-2026-87843
Oct 14, 2026
Researcher: Ryan Fabella
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant < 5.3.2 - Missing Authorization
5.3
CVE-2026-87968
Oct 14, 2026
Researcher: JunHee CHO
Title CVE ID CVSS Researchers Date
Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers CVE-2026-100159 4.8 YC_Infosec October 15, 2026
Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure CVE-2026-108092 4.3 Kazuma Matsumoto October 14, 2026
Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters CVE-2026-11905 4.3 Or Benit October 14, 2026
Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter CVE-2026-88043 7.2 John Ryan Albon October 14, 2026
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template CVE-2026-86803 6.5 hashiramasenju333 October 14, 2026
VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature CVE-2026-78087 6.4 theviper17y October 14, 2026
Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute CVE-2026-78001 6.4 Omar Elshopky (3l5h0pky) October 14, 2026
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' CVE-2026-18586 7.2 thevietronin October 14, 2026
Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter CVE-2026-18548 7.2 thevietronin October 14, 2026
Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter CVE-2026-18557 6.1 Dmitrii Ignatyev October 14, 2026
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields CVE-2026-17001 6.4 Luca Laytynher (LyT) October 14, 2026
Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID CVE-2026-17031 8.1 @nacento October 14, 2026
Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages' CVE-2026-15180 6.1 Suredsi Ulpada (cyberdesu) October 14, 2026
Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter CVE-2026-15090 7.5 Osvaldo Noe Gonzalez Del Rio (Os) October 14, 2026
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content CVE-2026-14572 6.4 Pham Duc Anh October 14, 2026
PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter CVE-2026-3712 7.3 Itthidej Aramsri (Boeing777) October 14, 2026
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter CVE-2026-108587 9.8 Osman Hussein October 14, 2026
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter CVE-2026-86461 8.8 Osman Hussein October 14, 2026
Trust Payments Gateway for WooCommerce < 3.1.0 - Missing Authorization CVE-2026-87843 5.3 Ryan Fabella October 14, 2026
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant < 5.3.2 - Missing Authorization CVE-2026-87968 5.3 JunHee CHO October 14, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 15, 2026
Vulns
1 Ananda Dhakal 193
2 Wordfence PRISM 70
3 Intrudify 48
4 João Pedro S Alcântara 42
5 nh4tvd 39
6 johska 34
7 Jakub Herman 31
8 Karthik Ramakrishnan 30
9 Artus KG 28
10 Naoki Kawahigashi 28
11 Enrico Marcolini 26
12 Bonds 26
13 Rafie Muhammad 25
14 Peter Tang 25
15 neurotx 22
16 Erwan LR 21
17 daroo 21
18 Francisco José Ramírez Vicente 20
19 Iñigo Sánchez Enciso 20
20 Tran Nguyen Bao Khanh 20

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation