PT-2026-46350

Unauthenticated Local File Inclusion in Kelly Young = 1.1.0 versions...

PT-2026-46366

Unauthenticated Local File Inclusion in Grecko = 5.17 versions...

PT-2026-46327

Unauthenticated Local File Inclusion in AirSupply = 2.0.0 versions...

PT-2026-46387

Name of the Vulnerable Software and Affected Versions WP Meta Sort Posts versions prior to 1.0 Description The WP Meta Sort Posts plugin for WordPress is subject to Cross-Site Request Forgery CSRF, a type of attack where an unauthorized user tricks a victim into performing actions they did not...

PT-2026-46345

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...

PT-2026-46356

Unauthenticated Local File Inclusion in Putter = 1.17 versions...

PT-2026-46359

Unauthenticated Local File Inclusion in Medeus = 1.14 versions...

PT-2026-46344

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3...

PT-2026-46336

Unauthenticated Local File Inclusion in Corbesier = 1.15.0 versions...

PT-2026-46332

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme = 1.2.2 versions...

PT-2026-46378

Unauthenticated Local File Inclusion in Line Agency = 1.3.1 versions...

PT-2026-46382

Unauthenticated Privilege Escalation in Support Ticket Management System = 1.9 versions...

PT-2026-46339

Unauthenticated Local File Inclusion in Snow Club = 1.1 versions...

PT-2026-46374

Unauthenticated Local File Inclusion in Orpheus = 1.3 versions...

PT-2026-46367

Unauthenticated Local File Inclusion in WineShop = 3.17 versions...

PT-2026-46321

Unauthenticated Cross Site Scripting XSS in Qreatix = 1.9.4 versions...

PT-2026-46347

Subscriber Broken Access Control in Genemy = 1.6.6 versions...

PT-2026-46360

Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...

Wordfence Bug Bounty Program Monthly Report – March 2026

In March 2026, the Wordfence Bug Bounty Program received 1718 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 18, 2026 to May 24, 2026)

Last week, there were 101 vulnerabilities disclosed in 88 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 69 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities i...