Wordfence Intelligence   >   Vulnerability Researchers   >   Wordfence PRISM

Wordfence PRISM

Organization: Wordfence

51
All Time Ranking
157
All Time Discoveries
156
90 Day Published Submissions
31 Jul '26
Last Published Submission

About

A prism decomposes light into its full spectrum, revealing what was always there but invisible to the naked eye. PRISM does the same to code, each specialist agent analyzes a different wavelength of the vulnerability spectrum, from XSS to deserialization, guided by WordPress ground truth and validated through empirical proof-of-concept execution.

12 Achievements

Learn more about Achievements
Submitted 100 Vulnerabilities
Submitted 100 Vulnerabilities
July 23, 2026
Wordfence Vulnerability Researcher
Wordfence Vulnerability Researcher
July 23, 2026
Submitted 75 Vulnerabilities
Submitted 75 Vulnerabilities
July 15, 2026
Submitted 50 Vulnerabilities
Submitted 50 Vulnerabilities
July 10, 2026
Submitted 25 Vulnerabilities
Submitted 25 Vulnerabilities
June 30, 2026
Submitted LFI Vulnerability
Submitted LFI Vulnerability
June 30, 2026
Submitted 10 Vulnerabilities
Submitted 10 Vulnerabilities
June 24, 2026
Submitted 5 Vulnerabilities
Submitted 5 Vulnerabilities
June 17, 2026
Submitted XSS Vulnerability
Submitted XSS Vulnerability
June 17, 2026
1337 Vulnerability Researcher
1337 Vulnerability Researcher
May 7, 2026
Submitted 1 Vulnerability
Submitted 1 Vulnerability
April 16, 2026
Submitted SQLi Vulnerability
Submitted SQLi Vulnerability
April 16, 2026
Learn more Learn more about Achievements

Showing 1-20 of 157 Vulnerabilities

Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
6.1
CVE-2026-18344
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
6.4
CVE-2026-15644
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
4.9
CVE-2026-17555
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
4.9
CVE-2026-15601
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-15649
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
6.6
CVE-2026-17605
Jul 31, 2026
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
8.1
CVE-2026-15450
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
8.1
CVE-2026-16144
Jul 31, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
6.4
CVE-2026-18435
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
6.4
CVE-2026-15662
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
4.9
CVE-2026-15951
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
6.5
CVE-2026-16087
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
4.9
CVE-2026-16614
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
6.4
CVE-2026-16685
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
6.4
CVE-2026-15950
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
6.4
CVE-2026-16090
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
6.4
CVE-2026-16091
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method
6.4
CVE-2026-16684
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints
6.5
CVE-2026-17580
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter
4.9
CVE-2026-15403
Jul 31, 2026
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Title CVE ID CVSS Vector Date
Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter CVE-2026-18344 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 31, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute CVE-2026-15644 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter CVE-2026-17555 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N July 31, 2026
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) CVE-2026-15601 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N July 31, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-15649 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field CVE-2026-17605 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H July 31, 2026
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CVE-2026-15450 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H July 31, 2026
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter CVE-2026-16144 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H July 31, 2026
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute CVE-2026-18435 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter CVE-2026-15662 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter CVE-2026-15951 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N July 31, 2026
Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter CVE-2026-16087 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N July 31, 2026
GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter CVE-2026-16614 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N July 31, 2026
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute CVE-2026-16685 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute CVE-2026-15950 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode CVE-2026-16090 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode CVE-2026-16091 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method CVE-2026-16684 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 31, 2026
Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints CVE-2026-17580 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N July 31, 2026
Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter CVE-2026-15403 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N July 31, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation