WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
4.9
CVE-2026-18386
Sep 9, 2026
Researcher: Nikola Kojic
Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
4.3
CVE-2026-15823
Sep 9, 2026
Researcher: Wordfence PRISM
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
6.4
CVE-2026-15820
Sep 9, 2026
Researcher: Wordfence PRISM
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
6.4
CVE-2026-15796
Sep 9, 2026
Researcher: Wordfence PRISM
Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
7.2
CVE-2026-76562
Sep 9, 2026
Researcher: Nabil Irawan
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
8.0
CVE-2026-14873
Sep 9, 2026
Researchers: Afan, moonge
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
7.5
CVE-2026-15019
Sep 9, 2026
Researcher: Spy0x7
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
9.8
CVE-2026-18351
Sep 9, 2026
Researcher: Adam Rayyan Aryasatya
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
8.8
CVE-2026-80099
Sep 8, 2026
Researcher: sorin vasile
YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
8.8
CVE-2026-14359
Sep 8, 2026
Researcher: Michele Genito
Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
7.2
CVE-2026-14989
Sep 8, 2026
Researcher: Naoya Takahashi (nakko)
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
6.4
CVE-2026-17149
Sep 8, 2026
Researcher: Wordfence PRISM
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
4.3
CVE-2026-15398
Sep 8, 2026
Researcher: Wordfence PRISM
WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter
6.5
CVE-2026-19778
Sep 8, 2026
Researcher: Wordfence PRISM
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
7.2
CVE-2026-75927
Sep 8, 2026
Researcher: Wordfence PRISM
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
4.3
CVE-2026-19802
Sep 8, 2026
Researcher: Nabil Irawan
WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
5.3
CVE ID Unknown
Sep 8, 2026
Researcher: Wordfence PRISM
Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
8.1
CVE-2026-76009
Sep 8, 2026
Researcher: Samuele Santonicola
ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
4.3
CVE-2026-8615
Sep 8, 2026
Researcher: Legion Hunter
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
5.3
CVE-2026-84908
Sep 8, 2026
Researcher: Wordfence PRISM
Title CVE ID CVSS Researchers Date
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter CVE-2026-18386 4.9 Nikola Kojic September 9, 2026
Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter CVE-2026-15823 4.3 Wordfence PRISM September 9, 2026
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting CVE-2026-15820 6.4 Wordfence PRISM September 9, 2026
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting CVE-2026-15796 6.4 Wordfence PRISM September 9, 2026
Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter CVE-2026-76562 7.2 Nabil Irawan September 9, 2026
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset CVE-2026-14873 8.0 Afan, moonge September 9, 2026
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment CVE-2026-15019 7.5 Spy0x7 September 9, 2026
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter CVE-2026-18351 9.8 Adam Rayyan Aryasatya September 9, 2026
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret CVE-2026-80099 8.8 sorin vasile September 8, 2026
YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user CVE-2026-14359 8.8 Michele Genito September 8, 2026
Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter CVE-2026-14989 7.2 Naoya Takahashi (nakko) September 8, 2026
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute CVE-2026-17149 6.4 Wordfence PRISM September 8, 2026
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption CVE-2026-15398 4.3 Wordfence PRISM September 8, 2026
WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter CVE-2026-19778 6.5 Wordfence PRISM September 8, 2026
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant CVE-2026-75927 7.2 Wordfence PRISM September 8, 2026
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter CVE-2026-19802 4.3 Nabil Irawan September 8, 2026
WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters 5.3 Wordfence PRISM September 8, 2026
Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint CVE-2026-76009 8.1 Samuele Santonicola September 8, 2026
ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function CVE-2026-8615 4.3 Legion Hunter September 8, 2026
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action CVE-2026-84908 5.3 Wordfence PRISM September 8, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 13, 2026
Vulns
1 Wordfence PRISM 89
2 Ananda Dhakal 56
3 daroo 49
4 Jakub Herman 38
5 Erwan LR 27
6 dutafi 25
7 Revanth Hari Narayana Matte 21
8 Shikhali Jamalzade 17
9 Asim Alshaya 16
10 Tran Nguyen Bao Khanh 15
11 Muni Nitish Kumar Yaddala 14
12 Sai Praneeth Koti 13
13 Artus KG 13
14 Osvaldo Noe Gonzalez Del Rio (Os) 12
15 Nabil Irawan 12
16 Supakiad S. (m3ez) (m3ez) 11
17 sungbyeongchan 10
18 Dmitrii Ignatyev 9
19 Shivamani Vastrala 8
20 Mohammed Abd Alrahman 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation