WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
4.7
CVE-2026-103912
Oct 9, 2026
Researcher: Zenith-sec
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
6.4
CVE-2026-103520
Oct 9, 2026
Researcher: zickzick2
Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
8.1
CVE-2026-92975
Oct 9, 2026
Researcher: Wordfence PRISM
Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
8.8
CVE-2026-104725
Oct 9, 2026
Researcher: Wordfence PRISM
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
3.1
CVE-2026-104742
Oct 9, 2026
Researcher: Wordfence PRISM
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
3.1
CVE-2026-104741
Oct 9, 2026
Researcher: Wordfence PRISM
GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
6.4
CVE-2026-97643
Oct 9, 2026
Researcher: Wordfence PRISM
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
8.1
CVE-2026-104899
Oct 9, 2026
Researcher: Wordfence PRISM
FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
8.8
CVE-2026-83526
Oct 9, 2026
Researcher: Supakiad S. (m3ez)
FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
8.8
CVE-2026-77183
Oct 9, 2026
Researcher: Supakiad S. (m3ez)
Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
6.4
CVE-2026-94421
Oct 9, 2026
Researcher: 刀 妖
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
6.4
CVE-2026-91862
Oct 9, 2026
Researcher: nthng
Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
6.4
CVE-2026-78068
Oct 9, 2026
Researcher: Omar Elshopky (3l5h0pky)
Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
6.4
CVE-2026-18558
Oct 9, 2026
Researcher: Deva Parekh
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
5.3
CVE-2026-18496
Oct 9, 2026
Researcher: Jonah Burgess (CryptoCat)
Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
6.4
CVE-2026-17025
Oct 9, 2026
Researcher: stealthcopter
Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
7.2
CVE-2026-96667
Oct 9, 2026
Researcher: Morato Antoine
Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
6.4
CVE-2026-14882
Oct 9, 2026
Researcher: Webbernaut
Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
6.4
CVE-2026-14877
Oct 9, 2026
Researcher: Webbernaut
GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
6.4
CVE-2026-14379
Oct 9, 2026
Researcher: Supakiad S. (m3ez)
Title CVE ID CVSS Researchers Date
JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer CVE-2026-103912 4.7 Zenith-sec October 9, 2026
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format CVE-2026-103520 6.4 zickzick2 October 9, 2026
Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion CVE-2026-92975 8.1 Wordfence PRISM October 9, 2026
Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter CVE-2026-104725 8.8 Wordfence PRISM October 9, 2026
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action CVE-2026-104742 3.1 Wordfence PRISM October 9, 2026
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint CVE-2026-104741 3.1 Wordfence PRISM October 9, 2026
GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes CVE-2026-97643 6.4 Wordfence PRISM October 9, 2026
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter CVE-2026-104899 8.1 Wordfence PRISM October 9, 2026
FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter CVE-2026-83526 8.8 Supakiad S. (m3ez) October 9, 2026
FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint CVE-2026-77183 8.8 Supakiad S. (m3ez) October 9, 2026
Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter CVE-2026-94421 6.4 刀 妖 October 9, 2026
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points' CVE-2026-91862 6.4 nthng October 9, 2026
Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content CVE-2026-78068 6.4 Omar Elshopky (3l5h0pky) October 9, 2026
Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode CVE-2026-18558 6.4 Deva Parekh October 9, 2026
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action CVE-2026-18496 5.3 Jonah Burgess (CryptoCat) October 9, 2026
Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields CVE-2026-17025 6.4 stealthcopter October 9, 2026
Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-96667 7.2 Morato Antoine October 9, 2026
Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta CVE-2026-14882 6.4 Webbernaut October 9, 2026
Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute CVE-2026-14877 6.4 Webbernaut October 9, 2026
GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter CVE-2026-14379 6.4 Supakiad S. (m3ez) October 9, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 13, 2026
Vulns
1 Ananda Dhakal 168
2 Wordfence PRISM 68
3 Intrudify 46
4 Jakub Herman 32
5 Karthik Ramakrishnan 31
6 Artus KG 31
7 nh4tvd 31
8 Rafie Muhammad 19
9 daroo 19
10 Iñigo Sánchez Enciso 18
11 Francisco José Ramírez Vicente 18
12 Pablo González Pérez 18
13 neurotx 18
14 Erwan LR 17
15 Supakiad S. (m3ez) 16
16 JunHee CHO 16
17 Peter Tang 16
18 vuxvinh 15
19 Kuba 15
20 Naoki Kawahigashi 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation