WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by GivMeInJ in WordPress Plugin Food Store – Online Food Delivery & Pickup versions = 1.5.5...

WordPress AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin <= 3.8.6 - Missing Authorization to Administrator Account Takeover vulnerability

Missing Authorization to Administrator Account Takeover vulnerability discovered by satoshigpt2021-sketch in WordPress Plugin AI Engine versions = 3.8.6...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.55.0.2 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Emiliano Versini in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Export and Import Users and Customers plugin <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Import Export WordPress Users versions = 2.7.5...

CVE-2025-6934

CVE-2025-6934 Auto Exploit ⚡ Overview CVE-2025-6934 is a proof-of-concept PoC exploit targeting WordPress Plugin: Opal Estate Pro ≤ 1.7.5. This exploit demonstrates unauthenticated administrator account creation. Disclaimer: This PoC is for educational purposes only. Do not use on systems without...

Mass-Scanner-CVE-2026-1405

⚡ Mass-Scanner-CVE-2026-1405 Clean WordPress Mass Scanner for CVE-2026-1405 🧠 Overview A clean and lightweight scanner built to check CVE-2026-1405 exposure across multiple WordPress targets. It focuses on: fast multi-target scanning clean terminal output simple result classification easy usage f...

WordPress Events Made Easy plugin <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Made Easy versions = 3.3.1...

npm: Vite: `server.fs.deny` bypassed with queries

npm: Vite: server.fs.deny bypassed with queries vulnerability discovered by ? in WordPress npm vite versions 6.4.4...

CVE-2026-61992

Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)

Last week, there were 268 vulnerabilities disclosed in 182 WordPress Plugins and 15 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 124 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

CVE-2026-118074 WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Finale Lite = 2.21.0 versions...

CVE-2026-118074

The Finale Lite WordPress plugin (versions

CVE-2026-61992

The GEO my WordPress plugin for WordPress is vulnerable to an unauthenticated PHP Object Injection vulnerability in versions

CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...

EUVD-2026-112959

Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...

CVE-2026-27394 WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Eventer = 0.1.1 versions...

CVE-2026-27394

The WordPress Eventer plugin (versions

CVE-2026-80069

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80067

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

CVE-2026-54852

Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...