112 matches found
Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)
Last week, there were 75 vulnerabilities disclosed in WordPress Core, 68 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 50 Vulnerability Researchers that contributed to WordPress Security last week. Review those...
PT-2026-46340
Unauthenticated Local File Inclusion in Especio = 1.0 versions...
EUVD-2026-24688
The Breaking News WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3. This is due to the brnwpajaxform AJAX endpoint lacking both authorization checks and CSRF verification, combined with insufficient path validation when the brnwptheme option...
EUVD-2024-47006
The Easy Image Collage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajaximagecollage function in all versions up to, and including, 1.13.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to...
CVE-2023-4281
This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic...
CVE-2016-10762
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used...
CVE-2016-10897
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues...
CVE-2017-18565
The updater plugin before 1.35 for WordPress has multiple XSS issues...
CVE-2017-18608
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues...
CVE-2017-18586
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
CVE-2017-18502
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues...
CVE-2017-18492
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues...
CVE-2017-18564
The sender plugin before 1.2.1 for WordPress has multiple XSS issues...
CVE-2024-2172
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress both by MiniOrange are vulnerable to privilege escalation due to a missing capability check on the mowpnsinit function in all versions up to, and including, 4.7.2 for Malware Scanner and 2.1.1 for Web Application...
EUVD-2016-1871
Malware in sbrugna...
EUVD-2021-11483
Malware in sbrugna...
EUVD-2010-4840
Malware in sbrugna...
EUVD-2017-9691
Malware in sbrugna...