131 matches found
CVE-2018-25437
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the downloadbackup.php endpoint. Attackers can directly access the downloadbackup.php script in the admin/datamanagement...
CVE-2026-3535
The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the DSGVOGWPdownloadGoogleFonts function in all versions up to, and including, 1.1. The function is exposed via a wpajaxnopriv hook, requiring no authentication. It...
PT-2026-46323
Unauthenticated Local File Inclusion in Imba = 1.5.0 versions...
PT-2026-46320
Unauthenticated Local File Inclusion in Geya = 1.15 versions...
PT-2026-46342
Unauthenticated Local File Inclusion in Fortius = 2.3.0 versions...
PT-2026-46372
Unauthenticated Local File Inclusion in Spike = 1.2 versions...
PT-2026-46363
Unauthenticated Local File Inclusion in Printo = 1.11 versions...
PT-2026-46329
Unauthenticated Local File Inclusion in Planty = 1.14.0 versions...
PT-2026-46328
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
PT-2026-46370
Unauthenticated Local File Inclusion in Gunslinger = 1.7 versions...
PT-2026-46322
Unauthenticated Local File Inclusion in Modernee = 1.6.0 versions...
PT-2026-46353
Unauthenticated Local File Inclusion in Preservation = 1.10 versions...
PT-2026-46331
Unauthenticated Local File Inclusion in MaxiNet = 1.2.10 versions...
PT-2026-46330
Unauthenticated Local File Inclusion in Nexio = 1.10.0 versions...
PT-2026-46367
Unauthenticated Local File Inclusion in WineShop = 3.17 versions...
PT-2026-46374
Unauthenticated Local File Inclusion in Orpheus = 1.3 versions...
Wordfence Bug Bounty Program Monthly Report – March 2026
In March 2026, the Wordfence Bug Bounty Program received 1718 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...
EUVD-2024-55564
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)
Last week, there were 139 vulnerabilities disclosed in 118 WordPress Plugins and 10 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 85 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...
WPProbe Plugin Enumeration Tool 0.11.2
A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5,000 plugins detectable without brute-force, thousands more with it...