WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
4.3
CVE-2026-19946
Sep 8, 2026
Researcher: Wordfence PRISM
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
7.2
CVE-2026-83593
Sep 8, 2026
Researcher: Ivaylo
WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode
4.3
CVE-2026-75905
Sep 8, 2026
Researcher: Wordfence PRISM
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
5.4
CVE-2026-11821
Sep 8, 2026
Researcher: Sushi Com Abacate
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
6.4
CVE-2026-19945
Sep 8, 2026
Researcher: Wordfence PRISM
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
4.9
CVE-2026-19944
Sep 8, 2026
Researcher: Wordfence PRISM
User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
6.1
CVE-2026-19797
Sep 8, 2026
Researcher: Wordfence PRISM
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
7.2
CVE-2026-17553
Sep 8, 2026
Researcher: Wordfence PRISM
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
6.1
CVE-2026-7804
Sep 8, 2026
Researcher: Yuto Hyakumoto
Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
6.4
CVE-2026-75966
Sep 8, 2026
Researcher: Wordfence PRISM
Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter
4.9
CVE-2026-19800
Sep 8, 2026
Researcher: Wordfence PRISM
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
6.6
CVE-2026-11363
Sep 8, 2026
Researcher: DungNhi
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
6.4
CVE-2026-77186
Sep 8, 2026
Researcher: Wordfence PRISM
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
6.4
CVE-2026-77187
Sep 8, 2026
Researcher: Wordfence PRISM
FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation
8.8
CVE-2026-76801
Sep 8, 2026
Researcher: Wordfence PRISM
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
7.5
CVE-2026-15667
Sep 8, 2026
Researcher: Wordfence PRISM
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
7.5
CVE-2026-15406
Sep 8, 2026
Researcher: Wordfence PRISM
Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
7.2
CVE-2026-13359
Sep 8, 2026
Researcher: Nabil Irawan
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
5.3
CVE-2026-12956
Sep 8, 2026
Researcher: Wordfence PRISM
Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values
7.2
CVE-2026-84293
Sep 8, 2026
Researcher: andrea bocchetti
Title CVE ID CVSS Researchers Date
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter CVE-2026-19946 4.3 Wordfence PRISM September 8, 2026
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter CVE-2026-83593 7.2 Ivaylo September 8, 2026
WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode CVE-2026-75905 4.3 Wordfence PRISM September 8, 2026
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint CVE-2026-11821 5.4 Sushi Com Abacate September 8, 2026
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-19945 6.4 Wordfence PRISM September 8, 2026
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta CVE-2026-19944 4.9 Wordfence PRISM September 8, 2026
User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter CVE-2026-19797 6.1 Wordfence PRISM September 8, 2026
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action CVE-2026-17553 7.2 Wordfence PRISM September 8, 2026
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter CVE-2026-7804 6.1 Yuto Hyakumoto September 8, 2026
Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter CVE-2026-75966 6.4 Wordfence PRISM September 8, 2026
Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter CVE-2026-19800 4.9 Wordfence PRISM September 8, 2026
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import CVE-2026-11363 6.6 DungNhi September 8, 2026
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute CVE-2026-77186 6.4 Wordfence PRISM September 8, 2026
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes CVE-2026-77187 6.4 Wordfence PRISM September 8, 2026
FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation CVE-2026-76801 8.8 Wordfence PRISM September 8, 2026
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter CVE-2026-15667 7.5 Wordfence PRISM September 8, 2026
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter CVE-2026-15406 7.5 Wordfence PRISM September 8, 2026
Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter CVE-2026-13359 7.2 Nabil Irawan September 8, 2026
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter CVE-2026-12956 5.3 Wordfence PRISM September 8, 2026
Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values CVE-2026-84293 7.2 andrea bocchetti September 8, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 13, 2026
Vulns
1 Wordfence PRISM 89
2 Ananda Dhakal 56
3 daroo 49
4 Jakub Herman 38
5 Erwan LR 27
6 dutafi 25
7 Revanth Hari Narayana Matte 21
8 Shikhali Jamalzade 17
9 Asim Alshaya 16
10 Tran Nguyen Bao Khanh 15
11 Muni Nitish Kumar Yaddala 14
12 Sai Praneeth Koti 13
13 Artus KG 13
14 Osvaldo Noe Gonzalez Del Rio (Os) 12
15 Nabil Irawan 12
16 Supakiad S. (m3ez) (m3ez) 11
17 sungbyeongchan 10
18 Dmitrii Ignatyev 9
19 Shivamani Vastrala 8
20 Mohammed Abd Alrahman 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation