323184 matches found
WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Gravity Forms versions = 3.1.2...
WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Tin Pham TF1T, Hao Ngo, Trong Pham in WordPress Plugin Gravity Forms versions = 3.1.2...
Wordfence Bug Bounty Program Monthly Report – July 2026
In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...
WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by GivMeInJ in WordPress Plugin Food Store – Online Food Delivery & Pickup versions = 1.5.5...
WordPress AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin <= 3.8.6 - Missing Authorization to Administrator Account Takeover vulnerability
Missing Authorization to Administrator Account Takeover vulnerability discovered by satoshigpt2021-sketch in WordPress Plugin AI Engine versions = 3.8.6...
WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.55.0.2 - Unauthenticated Limited File Deletion vulnerability
Unauthenticated Limited File Deletion vulnerability discovered by Emiliano Versini in WordPress Plugin Forminator versions = 1.55.0.2...
WordPress Export and Import Users and Customers plugin <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation vulnerability
Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Import Export WordPress Users versions = 2.7.5...
CVE-2025-6934
CVE-2025-6934 Auto Exploit ⚡ Overview CVE-2025-6934 is a proof-of-concept PoC exploit targeting WordPress Plugin: Opal Estate Pro ≤ 1.7.5. This exploit demonstrates unauthenticated administrator account creation. Disclaimer: This PoC is for educational purposes only. Do not use on systems without...
Mass-Scanner-CVE-2026-1405
⚡ Mass-Scanner-CVE-2026-1405 Clean WordPress Mass Scanner for CVE-2026-1405 🧠 Overview A clean and lightweight scanner built to check CVE-2026-1405 exposure across multiple WordPress targets. It focuses on: fast multi-target scanning clean terminal output simple result classification easy usage f...
WordPress Events Made Easy plugin <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Made Easy versions = 3.3.1...
npm: Vite: `server.fs.deny` bypassed with queries
npm: Vite: server.fs.deny bypassed with queries vulnerability discovered by ? in WordPress npm vite versions 6.4.4...
CVE-2026-61992
Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
Last week, there were 268 vulnerabilities disclosed in 182 WordPress Plugins and 15 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 124 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...
CVE-2026-118074 WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Finale Lite = 2.21.0 versions...
CVE-2026-118074
The Finale Lite WordPress plugin (versions
CVE-2026-61992
The GEO my WordPress plugin for WordPress is vulnerable to an unauthenticated PHP Object Injection vulnerability in versions
CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...
EUVD-2026-112959
Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...