wp_hunter

wphunter Static analysis to search for vulnerabilities in Wordpress plugins. / \ / \ / | \ / | \ // /| / \ | / \ / \ \ \ / | | \ Y / | / | \ | \ /| | / /\ / ||| /|/|| /| \ | / // / / / | Author: @JosueEncinar Starting the process Total plugins 87509 Starting the analisys How to add a...

wordpress-php-object-helper

wordpress-php-object-helper About You have a Known plugin with a PHP object exploit?, but you need to determine which library to use to exploit the issue and run with phpggc. This should help you out. Example Output $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

wpBullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security last week. Review those...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 86,413 Nuclei Templates for WordPress Security Scanning 🥳 Level up your WordPress security game! This project's got a treasure trove of fresh Nuclei templates for WordPress. Scan for weaknesses in Core, plugins, and themes – all based on the latest intel from Wordfence.com...

wpgarlic

wpgarlic Un fuzzer de plugins de WordPress como prueba de concepto que llevó al descubrimiento de más de 300 vulnerabilidades en plugins de WordPress instalados en casi 30 millones de sitios. La técnica utilizada se describe en https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html Si deseas...

wpbullet

wpBullet Un análisis estático de código para Plugins/Temas de WordPress y PHP Instalación Simplemente clona el repositorio, instala los requisitos y ejecuta el script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)

Last week, there were 318 vulnerabilities disclosed in 221 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 156 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to...

Wordfence Bug Bounty Program Monthly Report – June 2026

In June 2026, the Wordfence Bug Bounty Program received 1066 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)

Last week, there were 260 vulnerabilities disclosed in 207 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 147 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to...

WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved. "New plugins are reviewed before they enter the...

Wordfence Bug Bounty Program Monthly Report – May 2026

In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were 295 vulnerabilities disclosed in 196 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 159 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)

Last week, there were 274 vulnerabilities disclosed in 213 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 116 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

cve-autopsy

CVE Reversing Lab A personal training repo for practicing "N-...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 265 vulnerabilities disclosed in 202 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 144 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

WordPress MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by she11f in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

CVE-2026-14872

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...