wpprobe

"Because why scan blind when WordPress exposes itself?" WPProbe A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5000 plugins detectable without brute-force, thousands mo...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 77,636 Nuclei Templates for WordPress Security Scanning 🥳 ¡Lleva tu juego de seguridad de WordPress al siguiente nivel! Este proyecto tiene un verdadero tesoro de plantillas Nuclei actualizadas para WordPress. Escanea en busca de debilidades en el núcleo, los plugins y los...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were 277 vulnerabilities disclosed in 187 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 153 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2023-6875

CVE-2023-6875 CVE-2023-6875 PoC This is the original proof of concept given to Wordfence for my participation in its Holiday Bug Bonanza An extra was given for this proof of concept code Thank you to Wordfence for the opportunity! I had a lot of fun during the Bug Bonanza and hope that it happens...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress User Access Manager plugin <= 2.3.18 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin User Access Manager versions = 2.3.18...

WordPress FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation vulnerability

Authenticated Author+ Remote Code Execution to Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin FireBox versions = 3.1.10...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin myCred versions = 3.2.4...

WordPress WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin <= 2.23.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WooCommerce Google Feed Manager versions = 2.23.7...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Denial vulnerability discovered by Wordfence PRISM in WordPress Plugin Awesome Support versions = 6.3.9...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability

Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)

Last week, there were 266 vulnerabilities disclosed in 186 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 131 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...