wpprobe

“为什么要盲目扫描，而 WordPress 早已暴露自己？” WPProbe 一款快速的 WordPress 插件和主题扫描器，通过 REST API 枚举检测已安装的插件，并通过 HTML 发现主题，然后将其映射到已知漏洞。无需暴力破解即可检测超过 5000 个插件，使用暴力破解可检测数千个更多插件。 重要：Wordfence API 变更 自 2026 年 3 月 9 日起，Wordfence 弃用了其 v2 API。所有 v0.10.16 之前的 WPProbe 版本的 update-db 功能均已失效。您需要更新 WPProbe。 默认情况下，wpprobe update-db...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 77,636 个用于 WordPress 安全扫描的 Nuclei 模板 🥳 让你的 WordPress 安全水平更上一层楼！本项目汇集了海量全新的 Nuclei 模板，用于 WordPress 扫描。扫描核心（Core）、插件和主题中的弱点——全部基于 Wordfence.com 的最新情报。 为什么说它是你的新好朋友： 海量模板库 ：无需再四处寻找单个模板，整个武器库尽在你的指尖。 始终与时俱进 ：这些模板会随最新威胁持续更新，让你永远不会落后于形势。 开源魔法 ：需要针对特定场景调整模板？没问题，你拥有完全的控制权。 如果你正在守护...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were 277 vulnerabilities disclosed in 187 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 153 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2023-6875

CVE-2023-6875 PoC de CVE-2023-6875 Este es el proof of concept original entregado a Wordfence por mi participación en su Holiday Bug Bonanza Se otorgó un extra por este código de proof of concept ¡Gracias a Wordfence por la oportunidad! Me divertí mucho durante el Bug Bonanza y espero que se repi...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress User Access Manager plugin <= 2.3.18 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin User Access Manager versions = 2.3.18...

WordPress FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation vulnerability

Authenticated Author+ Remote Code Execution to Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin FireBox versions = 3.1.10...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin myCred versions = 3.2.4...

WordPress WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin <= 2.23.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WooCommerce Google Feed Manager versions = 2.23.7...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Denial vulnerability discovered by Wordfence PRISM in WordPress Plugin Awesome Support versions = 6.3.9...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability

Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)

Last week, there were 266 vulnerabilities disclosed in 186 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 131 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...