WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
9.8
CVE-2026-94589
Oct 9, 2026
Researcher: Osman Hussein
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
6.8
CVE-2026-104898
Oct 9, 2026
Researcher: Wordfence PRISM
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
5.3
CVE-2026-103365
Oct 9, 2026
Researcher: R3D
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
9.1
CVE-2026-107645
Oct 9, 2026
Researcher: Sawyer
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
9.8
CVE-2026-104732
Oct 9, 2026
Researcher: Wordfence PRISM
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
8.1
CVE-2026-104797
Oct 9, 2026
Researcher: wachiss
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
6.4
CVE-2026-96743
Oct 9, 2026
Researcher: Kuba
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
6.4
CVE-2026-93883
Oct 9, 2026
Researcher: Ivaylo
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
6.5
CVE-2026-104915
Oct 9, 2026
Researcher: Wordfence PRISM
Asgaros Forum <= 3.4.0 - Missing Authorization
4.3
CVE-2026-39779
Oct 9, 2026
Researcher: buitu
JetBlocks for Elementor <= 1.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-62049
Oct 9, 2026
Researcher: nh4tvd
Scripts n Styles <= 3.5.8 - Missing Authorization
5.3
CVE-2026-62042
Oct 9, 2026
Researcher: Que Thanh Tuan
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Missing Authorization
4.3
CVE-2026-62028
Oct 9, 2026
Researcher: Asim Alshaya
Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 - Missing Authorization
5.3
CVE-2026-62040
Oct 9, 2026
Researcher: Salúa Es-sair
Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery
4.3
CVE-2026-62026
Oct 9, 2026
Researcher: JunHee CHO
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization
4.3
CVE-2026-62041
Oct 9, 2026
Researcher: Tai Ha (superx)
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-62039
Oct 9, 2026
Researcher: Ananda Dhakal
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-62029
Oct 9, 2026
Researcher: nh4tvd
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
5.4
CVE-2026-104022
Oct 9, 2026
Researcher: Wordfence PRISM
AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization
4.3
CVE-2026-107419
Oct 9, 2026
Researcher: myhappyhoon
Title CVE ID CVSS Researchers Date
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload CVE-2026-94589 9.8 Osman Hussein October 9, 2026
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body CVE-2026-104898 6.8 Wordfence PRISM October 9, 2026
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details CVE-2026-103365 5.3 R3D October 9, 2026
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter CVE-2026-107645 9.1 Sawyer October 9, 2026
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler CVE-2026-104732 9.8 Wordfence PRISM October 9, 2026
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action CVE-2026-104797 8.1 wachiss October 9, 2026
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value CVE-2026-96743 6.4 Kuba October 9, 2026
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter CVE-2026-93883 6.4 Ivaylo October 9, 2026
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id CVE-2026-104915 6.5 Wordfence PRISM October 9, 2026
Asgaros Forum <= 3.4.0 - Missing Authorization CVE-2026-39779 4.3 buitu October 9, 2026
JetBlocks for Elementor <= 1.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-62049 6.4 nh4tvd October 9, 2026
Scripts n Styles <= 3.5.8 - Missing Authorization CVE-2026-62042 5.3 Que Thanh Tuan October 9, 2026
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Missing Authorization CVE-2026-62028 4.3 Asim Alshaya October 9, 2026
Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 - Missing Authorization CVE-2026-62040 5.3 Salúa Es-sair October 9, 2026
Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery CVE-2026-62026 4.3 JunHee CHO October 9, 2026
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization CVE-2026-62041 4.3 Tai Ha (superx) October 9, 2026
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-62039 6.4 Ananda Dhakal October 9, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-62029 6.4 nh4tvd October 9, 2026
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint CVE-2026-104022 5.4 Wordfence PRISM October 9, 2026
AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization CVE-2026-107419 4.3 myhappyhoon October 9, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 13, 2026
Vulns
1 Ananda Dhakal 168
2 Wordfence PRISM 68
3 Intrudify 46
4 Jakub Herman 32
5 Karthik Ramakrishnan 31
6 Artus KG 31
7 nh4tvd 31
8 Rafie Muhammad 19
9 daroo 19
10 Iñigo Sánchez Enciso 18
11 Francisco José Ramírez Vicente 18
12 Pablo González Pérez 18
13 neurotx 18
14 Erwan LR 17
15 Supakiad S. (m3ez) 16
16 JunHee CHO 16
17 Peter Tang 16
18 vuxvinh 15
19 Kuba 15
20 Naoki Kawahigashi 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation