Title	CVE ID	CVSS	Vector	Date
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.6.7 - Missing Authorization	CVE-2026-42776	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	May 26, 2026
Modular DS 2.5.2 - Unauthenticated Privilege Escalation	CVE-2026-23800	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	January 16, 2026
eForm - WordPress Form Builder < 4.19.1 - Reflected Cross-Site Scripting	CVE-2025-48333	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	June 11, 2025
wProject < 5.8.0 - Reflected Cross-Site Scripting	CVE-2025-39365	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	April 22, 2025
wProject < 5.8.0 - Missing Authorization to Unauthenticated Content Modification and Deletion	CVE-2025-39350	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	April 22, 2025
wProject < 5.8.0 - Authenticated (Subscriber+) Privilege Escalation	CVE-2025-39366	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	April 22, 2025
Seraphinite Accelerator <= 2.22.15 (2.21.13 PRO) - Authenticated (Subscriber+) Information Exposure	CVE-2024-54222	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	December 19, 2024
WP SuperBackup <= 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download	CVE-2024-56067	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	December 18, 2024
WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload	CVE-2024-56064	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 18, 2024
WP SuperBackup <= 2.3.3 - Authenticated (Subscriber+) PHP Object Injection	CVE-2024-56068	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	December 18, 2024
WP SuperBackup <= 2.3.3 - Reflected Cross-Site Scripting	CVE-2024-56069	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 18, 2024
WP SuperBackup <= 2.3.3 - Missing Authorization	CVE-2024-56070	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	December 18, 2024
ARForms <= 6.4.1 - Missing Authorization to Plugin Settings Change	CVE-2024-54217	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	December 2, 2024
FAT Services Booking <= 5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting	CVE-2024-54220	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	December 2, 2024
FAT Services Booking <= 5.6 - Unauthenticated SQL Injection	CVE-2024-54221	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	December 2, 2024
AIO Contact <= 2.8.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-54219	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	December 2, 2024
AIO Contact <= 2.8.1 - Missing Authorization	CVE-2024-54218	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	December 2, 2024
ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read	CVE-2024-54216	7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	December 2, 2024
Revy <= 1.18 - Unauthenticated Arbitrary File Upload	CVE-2024-54214	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	December 2, 2024
Revy <= 1.18 - Unauthenticated SQL Injection	CVE-2024-54215	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	December 2, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation