PT-2026-72876

Name of the Vulnerable Software and Affected Versions Wholesale Market versions prior to 2.2.3 Description The Wholesale Market plugin for WordPress allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator. This occurs when the site...

PT-2026-72154

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

PT-2026-72156

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 Description This issue is a generic SQL Injection that occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparati...

PT-2026-72152

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web...

PT-2026-72158

Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versions prior to 2.10.2.3 Description The Beaver Builder Page Builder plugin for WordPress contains a stored cross-site scripting issue. This occurs due to insufficient input sanitization and output escaping within...

PT-2026-72148

Name of the Vulnerable Software and Affected Versions Image Uploader for Welcart versions prior to 1.4.7 Description The Image Uploader for Welcart plugin for WordPress contains a SQL Injection flaw. This occurs because the plugin does not sufficiently escape the post title parameter and fails to...

PT-2026-72144

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...

PT-2026-72147

Name of the Vulnerable Software and Affected Versions MaxUpload – Big File Uploads – Increase Maximum File Upload Size versions prior to 1.4.1 Description An arbitrary file upload issue exists in the handle upload function. A filename-validation mismatch occurs because extension and MIME checks a...

PT-2026-72880

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description The plugin is susceptible to account takeover because the add front user update AJAX handler is accessible to unauthenticated users. The handler accepts an arbitrary truebooker wp user id value an...

PT-2026-72146

Name of the Vulnerable Software and Affected Versions User Session Synchronizer versions prior to 1.4.1 Description An authentication bypass exists that can lead to account takeover. The synchronize session function, which executes on every request, fails to validate nonces, capabilities, or shar...

PT-2026-72140

Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where...

40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin

On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...

Exploit for CVE-2026-12345

CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)

Last week, there were 294 vulnerabilities disclosed in 233 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 149 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

CVE-2020-9373

creationtimestamp| type| source ---|---|--- 2026-08-14 13:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/98039 2026-08-15 00:00:47+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/98039 2026-08-15 08:00:04+00:00| seen|...

WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...

WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...

WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...