WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Blocksy Companion Pro <= 2.1.46 - Unauthenticated Remote Code Execution
9.8
CVE-2026-57624
Jun 29, 2026
Researcher: Nguyen Ba Khanh
Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
9.8
CVE-2026-12415
Jun 26, 2026
Researcher: Alyudin Nafiie
AI Chatbot & Workflow Automation by AIWU <= 1.5.3 - Unauthenticated Privilege Escalation
9.8
CVE-2026-9810
Jun 26, 2026
Researcher: Khaled Alenazi (Nxploited)
Abandoned Cart Lite for WooCommerce <= 6.8.1 - Unauthenticated Privilege Escalation via Weak Recovery Link
9.8
CVE-2026-12585
Jun 25, 2026
Researcher: Shivamani Vastrala
OMGF Pro <= 5.2.6 - Unauthenticated Arbitrary File Upload via @import URL Reflection
9.8
CVE-2026-57700
Jun 25, 2026
Researchers: Nguyen Ngoc Duc (duc193), NETZLICHT
Happy Coders OTP Login for WooCommerce <= 2.7 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVE-2026-12492
Jun 25, 2026
Researcher: moonge
Shibboleth <= 2.5.3 - Unauthenticated Administrator Account Creation
9.8
CVE-2026-12281
Jun 24, 2026
Researcher: Khaled Alenazi (Nxploited)
Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
9.8
CVE-2026-12416
Jun 23, 2026
Researcher: Alyudin Nafiie
SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
9.8
CVE-2026-12417
Jun 23, 2026
Researcher: Alyudin Nafiie
Paytium: Mollie payment forms & donations <= 5.0.2 - Unauthenticated Privilege Escalation
9.8
CVE-2026-56030
Jun 23, 2026
Researcher: Nabil Irawan
Dokan Pro <= 5.0.4 - Unauthenticated Privilege Escalation
9.8
CVE-2026-56033
Jun 23, 2026
Researcher: VanTastic
Social Login, Passkeys, Magic Link & Email OTP < 1.4.1 - Unauthenticated Account Takeover via OTP Brute Force
9.8
CVE-2026-13142
Jun 23, 2026
Researchers: WPscan, Pedro Pinho
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVE-2026-11551
Jun 19, 2026
Researchers: thevietronin, minhgalaxy
BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
9.8
CVE-2026-7515
Jun 18, 2026
Researcher: Nguyen Ngoc Duc (duc193)
Enable CORS <= 2.0.3 - Backdoor
9.8
CVE-2026-54833
Jun 18, 2026
Researcher: Ananda Dhakal
DoLeads Integrator <= 1.2.2 - Unauthenticated Remote Code Execution
9.8
CVE-2026-4375
Jun 16, 2026
Researcher: Erwan LR
Uncanny Automator Pro 7.3.0.5 - Maliciously Injected Backdoor
9.8
CVE-2026-12375
Jun 16, 2026
Researcher: Mike Gozdiskowski
Registration Form for WooCommerce <= 1.0.9 - Unauthenticated Privilege Escalation
9.8
CVE-2026-54807
Jun 16, 2026
Researcher: ParkHyunWoo
Sigma Forms Pro <= 1.4.5 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-52705
Jun 15, 2026
Researcher: Nguyen Ba Khanh
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Upload
9.8
CVE-2025-69129
Jun 12, 2026
Researcher: Denver Jackson
Title CVE ID CVSS Researchers Date
Blocksy Companion Pro <= 2.1.46 - Unauthenticated Remote Code Execution CVE-2026-57624 9.8 Nguyen Ba Khanh June 29, 2026
Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter CVE-2026-12415 9.8 Alyudin Nafiie June 26, 2026
AI Chatbot & Workflow Automation by AIWU <= 1.5.3 - Unauthenticated Privilege Escalation CVE-2026-9810 9.8 Khaled Alenazi (Nxploited) June 26, 2026
Abandoned Cart Lite for WooCommerce <= 6.8.1 - Unauthenticated Privilege Escalation via Weak Recovery Link CVE-2026-12585 9.8 Shivamani Vastrala June 25, 2026
OMGF Pro <= 5.2.6 - Unauthenticated Arbitrary File Upload via @import URL Reflection CVE-2026-57700 9.8 Nguyen Ngoc Duc (duc193), NETZLICHT June 25, 2026
Happy Coders OTP Login for WooCommerce <= 2.7 - Unauthenticated Privilege Escalation via Account Takeover CVE-2026-12492 9.8 moonge June 25, 2026
Shibboleth <= 2.5.3 - Unauthenticated Administrator Account Creation CVE-2026-12281 9.8 Khaled Alenazi (Nxploited) June 24, 2026
Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter CVE-2026-12416 9.8 Alyudin Nafiie June 23, 2026
SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover CVE-2026-12417 9.8 Alyudin Nafiie June 23, 2026
Paytium: Mollie payment forms & donations <= 5.0.2 - Unauthenticated Privilege Escalation CVE-2026-56030 9.8 Nabil Irawan June 23, 2026
Dokan Pro <= 5.0.4 - Unauthenticated Privilege Escalation CVE-2026-56033 9.8 VanTastic June 23, 2026
Social Login, Passkeys, Magic Link & Email OTP < 1.4.1 - Unauthenticated Account Takeover via OTP Brute Force CVE-2026-13142 9.8 WPscan, Pedro Pinho June 23, 2026
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover CVE-2026-11551 9.8 thevietronin, minhgalaxy June 19, 2026
BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style CVE-2026-7515 9.8 Nguyen Ngoc Duc (duc193) June 18, 2026
Enable CORS <= 2.0.3 - Backdoor CVE-2026-54833 9.8 Ananda Dhakal June 18, 2026
DoLeads Integrator <= 1.2.2 - Unauthenticated Remote Code Execution CVE-2026-4375 9.8 Erwan LR June 16, 2026
Uncanny Automator Pro 7.3.0.5 - Maliciously Injected Backdoor CVE-2026-12375 9.8 Mike Gozdiskowski June 16, 2026
Registration Form for WooCommerce <= 1.0.9 - Unauthenticated Privilege Escalation CVE-2026-54807 9.8 ParkHyunWoo June 16, 2026
Sigma Forms Pro <= 1.4.5 - Unauthenticated Arbitrary File Upload CVE-2026-52705 9.8 Nguyen Ba Khanh June 15, 2026
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Upload CVE-2025-69129 9.8 Denver Jackson June 12, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 10, 2026
Vulns
1 Ananda Dhakal 171
2 Wordfence PRISM 68
3 Intrudify 46
4 Artus KG 36
5 Karthik Ramakrishnan 34
6 Jakub Herman 33
7 nh4tvd 32
8 Rafie Muhammad 19
9 daroo 19
10 Francisco José Ramírez Vicente 18
11 JunHee CHO 18
12 Pablo González Pérez 18
13 Iñigo Sánchez Enciso 18
14 neurotx 18
15 Erwan LR 18
16 Peter Tang 16
17 Supakiad S. (m3ez) 16
18 Naoki Kawahigashi 15
19 vuxvinh 15
20 Kuba 15

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation