Title	CVE ID	CVSS	Vector	Date
POUCO Import Users <= 1.0.0 - Unauthenticated Privilege Escalation	CVE-2026-16256	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	August 6, 2026
Login Social <= 1.0.4 - Unauthenticated Privilege Escalation via Account Takeover	CVE-2026-16261	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	August 6, 2026
Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload	CVE-2026-12872	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	August 6, 2026
ChamaWP – Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content < 1.0.13 - Unauthenticated PHP Object Injection	CVE-2025-15672	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	August 6, 2026
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command	CVE-2026-14483	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 30, 2026
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter	CVE-2026-14245	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 8, 2026
User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation	CVE-2026-11961	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	June 26, 2026
AI Chatbot & Workflow Automation by AIWU <= 1.5.3 - Unauthenticated Privilege Escalation	CVE-2026-9810	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 26, 2026
Shibboleth <= 2.5.3 - Unauthenticated Administrator Account Creation	CVE-2026-12281	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 24, 2026
Order Notification for WooCommerce – Get Audio Alert on new Orders < 3.6.3 - Unauthenticated Remote Code Execution	CVE-2025-15484	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 2, 2026
Timetics – Appointment Booking Calendar & Scheduling System < 1.0.52 - Missing Authorization	CVE-2025-15473	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 12, 2026
Datalogics Ecommerce Delivery – Datalogics < 2.6.60 - Unauthenticated Privilege Escalation	CVE-2026-2631	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	March 12, 2026
Restaurant Cafeteria <= 0.4.6 - Missing Authorization to (Subscriber+) Arbitrary Plugin Installation/Activation	CVE-2025-15445	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	March 6, 2026
Powerpack for LearnDash <= 1.2.0 - Unauthenticated Arbitrary Options Update	CVE-2026-2446	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	February 13, 2026
Login with Salesforce <= 1.0.2 - Authentication Bypass	CVE-2026-2418	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	February 12, 2026
Prime Listing Manager <= 1.1 - Unauthenticated Privilege Escalation via Account Takeover	CVE-2025-14892	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	January 22, 2026
Bookingor <= 1.0.12 - Missing Authorization	CVE-2025-12573	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	January 20, 2026
Post Slides <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion	CVE-2025-15491	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	January 16, 2026
Dreamer Blog <= 1.2 - Missing Authorization	CVE-2025-10915	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	January 14, 2026
e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion	CVE-2025-14829	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	December 23, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation