WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
4.3
CVE-2026-93342
Sep 22, 2026
Researcher: Doniyor Sotiboldiyev
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
4.3
CVE-2026-93344
Sep 22, 2026
Researcher: Doniyor Sotiboldiyev
Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2026-93661
Sep 22, 2026
Researcher: Hasyros
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-82850
Sep 22, 2026
Researcher: Usama Arshad
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-82849
Sep 22, 2026
Researcher: Karthik Ramakrishnan
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization to Authenticated (Subscriber+) Refund Requests
4.3
CVE-2026-93341
Sep 22, 2026
Researcher: Doniyor Sotiboldiyev
MasterStudy LMS <= 3.7.49 - Missing Authorization
4.3
CVE-2026-88845
Sep 22, 2026
Researcher: vuxvinh
WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2026-89004
Sep 22, 2026
Researcher: Karthik Ramakrishnan
Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-93662
Sep 22, 2026
Researcher: Karthik Ramakrishnan
CMB2 <= 2.12.0 - Missing Authorization
4.3
CVE-2026-80338
Sep 22, 2026
Researcher: Mutantgun
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
4.3
CVE-2026-9004
Sep 21, 2026
Researcher: Teerachai Somprasong
ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
4.3
CVE-2026-7622
Sep 21, 2026
Researcher: Que Thanh Tuan
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
4.3
CVE-2026-91092
Sep 21, 2026
Researcher: Jonah Burgess (CryptoCat)
WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
4.3
CVE-2026-18345
Sep 21, 2026
Researcher: Wordfence PRISM
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
4.3
CVE-2026-18439
Sep 21, 2026
Researcher: Nakul Chodha
RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
4.3
CVE-2026-4123
Sep 21, 2026
Researcher: Nabil Irawan
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
4.3
CVE-2026-12995
Sep 21, 2026
Researcher: Dmitrii Ignatyev
Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-84150
Sep 21, 2026
Researcher: Revanth Hari Narayana Matte
WC Fields Factory <= 4.1.10 - Missing Authorization
4.3
CVE-2026-93508
Sep 21, 2026
Researcher: Farid Narimanov
MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-81339
Sep 21, 2026
Researcher: Revanth Hari Narayana Matte
Title CVE ID CVSS Researchers Date
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization CVE-2026-93342 4.3 Doniyor Sotiboldiyev September 22, 2026
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization CVE-2026-93344 4.3 Doniyor Sotiboldiyev September 22, 2026
Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference CVE-2026-93661 4.3 Hasyros September 22, 2026
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure CVE-2026-82850 4.3 Usama Arshad September 22, 2026
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-82849 4.3 Karthik Ramakrishnan September 22, 2026
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization to Authenticated (Subscriber+) Refund Requests CVE-2026-93341 4.3 Doniyor Sotiboldiyev September 22, 2026
MasterStudy LMS <= 3.7.49 - Missing Authorization CVE-2026-88845 4.3 vuxvinh September 22, 2026
WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Insecure Direct Object Reference CVE-2026-89004 4.3 Karthik Ramakrishnan September 22, 2026
Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure CVE-2026-93662 4.3 Karthik Ramakrishnan September 22, 2026
CMB2 <= 2.12.0 - Missing Authorization CVE-2026-80338 4.3 Mutantgun September 22, 2026
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter CVE-2026-9004 4.3 Teerachai Somprasong September 21, 2026
ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation CVE-2026-7622 4.3 Que Thanh Tuan September 21, 2026
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie CVE-2026-91092 4.3 Jonah Burgess (CryptoCat) September 21, 2026
WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback CVE-2026-18345 4.3 Wordfence PRISM September 21, 2026
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter CVE-2026-18439 4.3 Nakul Chodha September 21, 2026
RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action CVE-2026-4123 4.3 Nabil Irawan September 21, 2026
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter CVE-2026-12995 4.3 Dmitrii Ignatyev September 21, 2026
Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-84150 4.3 Revanth Hari Narayana Matte September 21, 2026
WC Fields Factory <= 4.1.10 - Missing Authorization CVE-2026-93508 4.3 Farid Narimanov September 21, 2026
MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-81339 4.3 Revanth Hari Narayana Matte September 21, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 9, 2026
Vulns
1 Ananda Dhakal 173
2 Wordfence PRISM 50
3 Intrudify 46
4 Artus KG 36
5 Karthik Ramakrishnan 35
6 Jakub Herman 32
7 nh4tvd 31
8 daroo 21
9 Rafie Muhammad 19
10 neurotx 18
11 Erwan LR 18
12 Iñigo Sánchez Enciso 18
13 Francisco José Ramírez Vicente 18
14 Pablo González Pérez 18
15 JunHee CHO 18
16 Kuba 16
17 Pedro Pinho 16
18 Peter Tang 16
19 Usama Arshad 15
20 Naoki Kawahigashi 15

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation