WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
8.1
CVE-2026-15979
Aug 4, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)
Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-15941
Aug 4, 2026
Researcher: daroo
Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
6.1
CVE-2026-8790
Aug 4, 2026
Researcher: whitesector
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
6.5
CVE-2026-11421
Aug 4, 2026
Researcher: Hyunsoo Jeong
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
9.3
CVE-2026-9273
Aug 4, 2026
Researcher: scort
Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation
8.8
CVE-2026-8761
Aug 4, 2026
Researcher: kai63001
Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-17506
Aug 4, 2026
Researcher: daroo
VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-16143
Aug 4, 2026
Researcher: nthng
VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
7.5
CVE-2026-15918
Aug 4, 2026
Researcher: nthng
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
8.8
CVE-2026-18322
Aug 4, 2026
Researcher: daroo
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
7.5
CVE-2026-13395
Aug 3, 2026
Researcher: Jakub Herman
Remote API <= 0.2 - Unauthenticated PHP Object Injection
8.1
CVE-2026-14602
Aug 3, 2026
Researcher: Pedro Pinho
MotoPress Hotel Booking < 6.0.4 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-15235
Aug 3, 2026
Researcher: Sanjorn Keeratirungsan
Fluent Forms Pro 6.2.7 & Ninja Tables Pro 5.2.13 - Remote Code Execution via Backdoor
9.8
CVE ID Unknown
Aug 3, 2026
Researchers:
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
9.8
CVE-2026-8457
Aug 1, 2026
Researcher: Rafie Muhammad
User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
7.5
CVE-2026-18352
Aug 1, 2026
Researcher: Supakiad S. (m3ez)
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
7.5
CVE-2026-13339
Aug 1, 2026
Researcher: Nhien Pham (nhienit)
Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
6.4
CVE-2026-12231
Aug 1, 2026
Researcher: Dmitrii Ignatyev
JetBlocks for Elementor <= 1.5.0 - Unauthenticated Information Exposure
5.3
CVE-2026-61976
Aug 1, 2026
Researcher: Ananda Dhakal
JetSearch <= 3.6.1.2 - Unauthenticated Information Exposure
5.3
CVE-2026-61977
Aug 1, 2026
Researcher: Ananda Dhakal
Title CVE ID CVSS Researchers Date
Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion CVE-2026-15979 8.1 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777) August 4, 2026
Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection CVE-2026-15941 6.5 daroo August 4, 2026
Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting CVE-2026-8790 6.1 whitesector August 4, 2026
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter CVE-2026-11421 6.5 Hyunsoo Jeong August 4, 2026
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover CVE-2026-9273 9.3 scort August 4, 2026
Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation CVE-2026-8761 8.8 kai63001 August 4, 2026
Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-17506 7.2 daroo August 4, 2026
VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-16143 7.2 nthng August 4, 2026
VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection CVE-2026-15918 7.5 nthng August 4, 2026
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator CVE-2026-18322 8.8 daroo August 4, 2026
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection CVE-2026-13395 7.5 Jakub Herman August 3, 2026
Remote API <= 0.2 - Unauthenticated PHP Object Injection CVE-2026-14602 8.1 Pedro Pinho August 3, 2026
MotoPress Hotel Booking < 6.0.4 - Authenticated (Subscriber+) Information Exposure CVE-2026-15235 4.3 Sanjorn Keeratirungsan August 3, 2026
Fluent Forms Pro 6.2.7 & Ninja Tables Pro 5.2.13 - Remote Code Execution via Backdoor 9.8 August 3, 2026
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT CVE-2026-8457 9.8 Rafie Muhammad August 1, 2026
User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter CVE-2026-18352 7.5 Supakiad S. (m3ez) August 1, 2026
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter CVE-2026-13339 7.5 Nhien Pham (nhienit) August 1, 2026
Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image' CVE-2026-12231 6.4 Dmitrii Ignatyev August 1, 2026
JetBlocks for Elementor <= 1.5.0 - Unauthenticated Information Exposure CVE-2026-61976 5.3 Ananda Dhakal August 1, 2026
JetSearch <= 3.6.1.2 - Unauthenticated Information Exposure CVE-2026-61977 5.3 Ananda Dhakal August 1, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jul 10, 2026
Vulns
1 Wordfence PRISM 102
2 Ananda Dhakal 78
3 daroo 22
4 Nabil Irawan 10
5 dutafi 10
6 Legion Hunter 8
7 Trương Hữu Phúc (truonghuuphuc) 7
8 Abdullah Kareem "cyberkareem" 6
9 Itthidej Aramsri (Boeing777) 6
10 Que Thanh Tuan 6
11 Phat RiO 6
12 Rafie Muhammad 5
13 zaim 5
14 luc 5
15 hhhai 5
16 Nguyen Ba Khanh 5
17 Dmitrii Ignatyev 5
18 dodoh4t 4
19 VanTastic 4
20 Athiwat Tiprasaharn (Jitlada) 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation