Title	CVE ID	CVSS	Vector	Date
Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter	CVE-2026-8944	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	June 29, 2026
WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update	CVE-2026-8940	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	June 8, 2026
FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save	CVE-2026-8904	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	June 8, 2026
AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update	CVE-2026-8902	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	June 8, 2026
Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update	CVE-2026-9599	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	June 1, 2026
MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page	CVE-2026-8942	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 26, 2026
GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function	CVE-2026-8943	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 26, 2026
CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update	CVE-2026-8941	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 26, 2026
Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update	CVE-2026-8939	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 26, 2026
auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass	CVE-2026-8938	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 26, 2026
Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update	CVE-2026-8903	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 26, 2026
Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update	CVE-2026-7614	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 26, 2026
Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form	CVE-2026-6932	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 11, 2026
Zawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter	CVE-2026-7616	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 11, 2026
DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update	CVE-2026-6700	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 4, 2026
TextP2P Texting Widget <= 1.8 - Cross-Site Request Forgery to Settings Update	CVE-2026-4133	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 21, 2026
Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update	CVE-2026-4121	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 21, 2026
Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update	CVE-2026-4118	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 21, 2026
mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function	CVE-2026-4139	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 21, 2026
DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update	CVE-2026-4138	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	April 21, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation