WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter
9.8
CVE-2026-14900
Jul 28, 2026
Researcher: Nox Axter
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation
9.8
CVE-2025-10656
Jul 28, 2026
Researcher: kr0d
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - 10.8.8 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter
9.8
CVE-2026-18072
Jul 28, 2026
Researcher: Wordfence PRISM
AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation
9.8
CVE-2026-65507
Jul 28, 2026
Researcher: qdtad
SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
9.8
CVE-2026-15014
Jul 27, 2026
Researcher: Civitasmass
Bit Assist <= 1.8.1 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-16548
Jul 27, 2026
Researcher: Vaibhav Narkhede
Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-16250
Jul 24, 2026
Researcher: João Ramos Maciel
SoftMarket <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVE-2026-14557
Jul 24, 2026
Researcher: Pedro Pinho
Multiple Supsystic Pro Plugins <= 1.6.0 - Backdoored Software via Compromised Vendor Software
9.8
CVE-2026-17032
Jul 24, 2026
Researcher: Mike Gozdiskowski
ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-16618
Jul 24, 2026
Researcher: João Ramos Maciel
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
9.8
CVE-2026-15981
Jul 23, 2026
Researcher: Supakiad S. (m3ez)
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint
9.8
CVE-2026-15015
Jul 22, 2026
Researcher: AeonRisk
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
9.8
CVE-2026-14282
Jul 22, 2026
Researcher: CHOIGYEONGMIN
Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
9.8
CVE-2026-15011
Jul 22, 2026
Researcher: theviper17y
WP BASE Booking of Appointments, Services and Events <= 6.3.1 - Authenticated (Subscriber+) Privilege Escalation
9.8
CVE-2026-59541
Jul 22, 2026
Researcher: Afan
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation
9.8
CVE-2026-59540
Jul 22, 2026
Researcher: Taylsec
Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
9.8
CVE-2026-13439
Jul 20, 2026
Researcher: CHOIGYEONGMIN
Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation
9.8
CVE-2026-14561
Jul 20, 2026
Researcher: 0xBassia
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
9.8
CVE-2026-63030
Jul 17, 2026
Researcher: Adam Kues
TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation
9.8
CVE-2026-61951
Jul 17, 2026
Researcher: yangsori
Title CVE ID CVSS Researchers Date
Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter CVE-2026-14900 9.8 Nox Axter July 28, 2026
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation CVE-2025-10656 9.8 kr0d July 28, 2026
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - 10.8.8 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter CVE-2026-18072 9.8 Wordfence PRISM July 28, 2026
AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation CVE-2026-65507 9.8 qdtad July 28, 2026
SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter CVE-2026-15014 9.8 Civitasmass July 27, 2026
Bit Assist <= 1.8.1 - Unauthenticated Arbitrary File Upload CVE-2026-16548 9.8 Vaibhav Narkhede July 27, 2026
Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload CVE-2026-16250 9.8 João Ramos Maciel July 24, 2026
SoftMarket <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover CVE-2026-14557 9.8 Pedro Pinho July 24, 2026
Multiple Supsystic Pro Plugins <= 1.6.0 - Backdoored Software via Compromised Vendor Software CVE-2026-17032 9.8 Mike Gozdiskowski July 24, 2026
ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload CVE-2026-16618 9.8 João Ramos Maciel July 24, 2026
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter CVE-2026-15981 9.8 Supakiad S. (m3ez) July 23, 2026
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint CVE-2026-15015 9.8 AeonRisk July 22, 2026
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field CVE-2026-14282 9.8 CHOIGYEONGMIN July 22, 2026
Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter CVE-2026-15011 9.8 theviper17y July 22, 2026
WP BASE Booking of Appointments, Services and Events <= 6.3.1 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-59541 9.8 Afan July 22, 2026
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation CVE-2026-59540 9.8 Taylsec July 22, 2026
Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint CVE-2026-13439 9.8 CHOIGYEONGMIN July 20, 2026
Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation CVE-2026-14561 9.8 0xBassia July 20, 2026
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion CVE-2026-63030 9.8 Adam Kues July 17, 2026
TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation CVE-2026-61951 9.8 yangsori July 17, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 9, 2026
Vulns
1 Ananda Dhakal 148
2 Wordfence PRISM 42
3 Intrudify 41
4 Artus KG 34
5 Karthik Ramakrishnan 34
6 Jakub Herman 31
7 nh4tvd 24
8 daroo 19
9 Iñigo Sánchez Enciso 18
10 Francisco José Ramírez Vicente 18
11 Pablo González Pérez 18
12 JunHee CHO 16
13 Erwan LR 15
14 Usama Arshad 15
15 Pedro Pinho 14
16 Kuba 14
17 Naoki Kawahigashi 14
18 vuxvinh 13
19 Dmitrii Ignatyev 13
20 Charles Vosburgh 13

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation