WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
5.3
CVE-2026-3424
Aug 21, 2026
Researcher: Ronnachai Sretawat Na Ayutaya (Simonhaskelly)
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
9.8
CVE-2026-78003
Aug 21, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-16617
Aug 21, 2026
Researcher: Ruwantha Harshamal
YayCurrency – WooCommerce Multi-Currency Switcher < 3.3.5 - Unauthenticated Information Exposure
5.3
CVE-2026-16058
Aug 21, 2026
Researcher: Shivamani Vastrala
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution
7.2
CVE-2026-13405
Aug 21, 2026
Researcher: Muni Nitish Kumar Yaddala
Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection
7.5
CVE-2026-16950
Aug 21, 2026
Researcher: João Ramos Maciel
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-19697
Aug 21, 2026
Researcher: Yaswanth Reddy Sunkara
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
4.3
CVE-2026-19416
Aug 21, 2026
Researcher: Erwan LR
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
6.4
CVE-2026-4561
Aug 21, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
4.3
CVE-2026-4244
Aug 21, 2026
Researcher: Abi Wiranata
JSON Options <= 0.0.4 - Unauthenticated Remote Code Execution
9.8
CVE-2026-75860
Aug 21, 2026
Researcher: Khaled Alenazi
Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request
7.5
CVE-2026-2996
Aug 21, 2026
Researcher: Andrés Cruciani
WPS Bidouille < 1.33.5 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-19782
Aug 21, 2026
Researcher: Shikhali Jamalzade
TabaPay Gateway <= 1.4.0 - Unauthenticated Privilege Escalation
7.3
CVE-2026-18031
Aug 21, 2026
Researcher: moonge
Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-19615
Aug 21, 2026
Researcher: Mohammed Abd Alrahman
Easy Appointments < 4.0.1 - Authenticated (Contributor+) Information Exposure
4.3
CVE-2026-19406
Aug 21, 2026
Researcher: Shikhali Jamalzade
Depicter — Popup & Slider Builder < 4.8.0 - Authenticated (Editor+) Arbitrary File Upload
7.2
CVE-2026-15049
Aug 21, 2026
Researcher: Md. Minaruzzaman Shovon
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2026-74992
Aug 21, 2026
Researcher: Mohammed Abd Alrahman
Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
4.3
CVE-2026-5093
Aug 21, 2026
Researcher: Raihan Adi Arba
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization
4.3
CVE-2026-18466
Aug 21, 2026
Researcher: Xanlar Agamalizade
Title CVE ID CVSS Researchers Date
kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter CVE-2026-3424 5.3 Ronnachai Sretawat Na Ayutaya (Simonhaskelly) August 21, 2026
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys CVE-2026-78003 9.8 Osvaldo Noe Gonzalez Del Rio (Os) August 21, 2026
Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting CVE-2026-16617 7.2 Ruwantha Harshamal August 21, 2026
YayCurrency – WooCommerce Multi-Currency Switcher < 3.3.5 - Unauthenticated Information Exposure CVE-2026-16058 5.3 Shivamani Vastrala August 21, 2026
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution CVE-2026-13405 7.2 Muni Nitish Kumar Yaddala August 21, 2026
Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection CVE-2026-16950 7.5 João Ramos Maciel August 21, 2026
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-19697 6.4 Yaswanth Reddy Sunkara August 21, 2026
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization CVE-2026-19416 4.3 Erwan LR August 21, 2026
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages CVE-2026-4561 6.4 Osvaldo Noe Gonzalez Del Rio (Os) August 21, 2026
Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution CVE-2026-4244 4.3 Abi Wiranata August 21, 2026
JSON Options <= 0.0.4 - Unauthenticated Remote Code Execution CVE-2026-75860 9.8 Khaled Alenazi August 21, 2026
Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request CVE-2026-2996 7.5 Andrés Cruciani August 21, 2026
WPS Bidouille < 1.33.5 - Authenticated (Subscriber+) Information Exposure CVE-2026-19782 4.3 Shikhali Jamalzade August 21, 2026
TabaPay Gateway <= 1.4.0 - Unauthenticated Privilege Escalation CVE-2026-18031 7.3 moonge August 21, 2026
Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-19615 6.4 Mohammed Abd Alrahman August 21, 2026
Easy Appointments < 4.0.1 - Authenticated (Contributor+) Information Exposure CVE-2026-19406 4.3 Shikhali Jamalzade August 21, 2026
Depicter — Popup & Slider Builder < 4.8.0 - Authenticated (Editor+) Arbitrary File Upload CVE-2026-15049 7.2 Md. Minaruzzaman Shovon August 21, 2026
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2026-74992 4.4 Mohammed Abd Alrahman August 21, 2026
Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' CVE-2026-5093 4.3 Raihan Adi Arba August 21, 2026
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization CVE-2026-18466 4.3 Xanlar Agamalizade August 21, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 8, 2026
Vulns
1 Wordfence PRISM 66
2 daroo 46
3 Ananda Dhakal 40
4 Jakub Herman 27
5 Erwan LR 23
6 dutafi 21
7 Asim Alshaya 20
8 Tran Nguyen Bao Khanh 17
9 Shikhali Jamalzade 14
10 Muni Nitish Kumar Yaddala 14
11 Osvaldo Noe Gonzalez Del Rio (Os) 11
12 Sai Praneeth Koti 10
13 Farid Narimanov 10
14 Dmitrii Ignatyev 9
15 Revanth Hari Narayana Matte 9
16 Nabil Irawan 9
17 Pedro Pinho 9
18 Artus KG 7
19 Shivamani Vastrala 7
20 Nir Yehoshua 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation