277348 matches found
PT-2026-72146
Name of the Vulnerable Software and Affected Versions User Session Synchronizer versions prior to 1.4.1 Description An authentication bypass exists that can lead to account takeover. The synchronize session function, which executes on every request, fails to validate nonces, capabilities, or shar...
PT-2026-72140
Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where...
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...
Exploit for CVE-2026-12345
CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)
Last week, there were 294 vulnerabilities disclosed in 233 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 149 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...
CVE-2020-9373
creationtimestamp| type| source ---|---|--- 2026-08-14 13:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/98039 2026-08-15 00:00:47+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/98039 2026-08-15 08:00:04+00:00| seen|...
WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...
WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Quill Forms versions = 5.7.1...
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...
WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...
WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability
Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin Starter Templates by Kadence WP versions = 2.3.3...
WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin Site Reviews versions = 8.2.0...
WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin CTX Feed versions = 6.6.47...
WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Abduvoris Karimov in WordPress Plugin OttoKit versions = 1.1.35...