WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name
7.2
CVE-2026-96564
Oct 2, 2026
Researcher: Adrien Brunner
WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
6.1
CVE-2026-103888
Oct 2, 2026
Researcher: Kuba
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
8.1
CVE-2026-101923
Oct 2, 2026
Researcher: Ivaylo
Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
6.4
CVE-2026-100148
Oct 2, 2026
Researcher: Jakub Herman
Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
7.2
CVE-2026-97341
Oct 2, 2026
Researcher: Kuba
Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget
6.4
CVE-2025-12828
Oct 2, 2026
Researcher: Abu Hurayra (HurayraIIT)
Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
7.2
CVE-2026-87091
Oct 2, 2026
Researcher: minhgalaxy
Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter
4.3
CVE-2026-11399
Oct 2, 2026
Researcher: Saruul
Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
7.2
CVE-2026-96650
Oct 2, 2026
Researcher: Tarcísio Luchesi De Almeida Silva (Poystick)
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…
5.3
CVE-2026-100149
Oct 2, 2026
Researcher: walid213
Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
7.5
CVE-2026-97337
Oct 2, 2026
Researcher: Kuba
Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
7.2
CVE-2026-96575
Oct 2, 2026
Researcher: theviper17y
Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
7.2
CVE-2026-101928
Oct 2, 2026
Researcher: Afifudin Maarif
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
7.5
CVE-2026-103913
Oct 2, 2026
Researcher: Samuele Santonicola
Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
6.1
CVE-2026-103909
Oct 2, 2026
Researcher: UKO
Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action
4.3
CVE-2026-91108
Oct 2, 2026
Researcher: Webbernaut
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
6.5
CVE-2026-100152
Oct 2, 2026
Researcher: Kuba
Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
4.3
CVE ID Unknown
Oct 2, 2026
Researcher: Wordfence PRISM
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment
7.2
CVE-2026-92977
Oct 2, 2026
Researcher: Pham Duc Anh
Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
8.8
CVE-2026-97644
Oct 2, 2026
Researcher: Supakiad S. (m3ez)
Title CVE ID CVSS Researchers Date
SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name CVE-2026-96564 7.2 Adrien Brunner October 2, 2026
WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter CVE-2026-103888 6.1 Kuba October 2, 2026
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter CVE-2026-101923 8.1 Ivaylo October 2, 2026
Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API) CVE-2026-100148 6.4 Jakub Herman October 2, 2026
Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header CVE-2026-97341 7.2 Kuba October 2, 2026
Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget CVE-2025-12828 6.4 Abu Hurayra (HurayraIIT) October 2, 2026
Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters CVE-2026-87091 7.2 minhgalaxy October 2, 2026
Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter CVE-2026-11399 4.3 Saruul October 2, 2026
Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field CVE-2026-96650 7.2 Tarcísio Luchesi De Almeida Silva (Poystick) October 2, 2026
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`… CVE-2026-100149 5.3 walid213 October 2, 2026
Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints CVE-2026-97337 7.5 Kuba October 2, 2026
Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder CVE-2026-96575 7.2 theviper17y October 2, 2026
Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author CVE-2026-101928 7.2 Afifudin Maarif October 2, 2026
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing CVE-2026-103913 7.5 Samuele Santonicola October 2, 2026
Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation CVE-2026-103909 6.1 UKO October 2, 2026
Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action CVE-2026-91108 4.3 Webbernaut October 2, 2026
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter CVE-2026-100152 6.5 Kuba October 2, 2026
Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route 4.3 Wordfence PRISM October 2, 2026
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment CVE-2026-92977 7.2 Pham Duc Anh October 2, 2026
Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test CVE-2026-97644 8.8 Supakiad S. (m3ez) October 2, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 5, 2026
Vulns
1 Ananda Dhakal 75
2 Wordfence PRISM 65
3 Karthik Ramakrishnan 34
4 Jakub Herman 30
5 Artus KG 30
6 Intrudify 20
7 daroo 19
8 nh4tvd 17
9 Kuba 14
10 Erwan LR 14
11 Pablo González Pérez 14
12 Francisco José Ramírez Vicente 14
13 Dmitrii Ignatyev 14
14 Iñigo Sánchez Enciso 14
15 h0xilo 13
16 vuxvinh 12
17 Revanth Hari Narayana Matte 12
18 Charles Vosburgh 12
19 Supakiad S. (m3ez) 12
20 Pedro Pinho 12

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation