276989 matches found
PT-2026-72148
Name of the Vulnerable Software and Affected Versions Image Uploader for Welcart versions prior to 1.4.7 Description The Image Uploader for Welcart plugin for WordPress contains a SQL Injection flaw. This occurs because the plugin does not sufficiently escape the post title parameter and fails to...
PT-2026-72147
Name of the Vulnerable Software and Affected Versions MaxUpload – Big File Uploads – Increase Maximum File Upload Size versions prior to 1.4.1 Description An arbitrary file upload issue exists in the handle upload function. A filename-validation mismatch occurs because extension and MIME checks a...
PT-2026-72144
Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...
PT-2026-72158
Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versions prior to 2.10.2.3 Description The Beaver Builder Page Builder plugin for WordPress contains a stored cross-site scripting issue. This occurs due to insufficient input sanitization and output escaping within...
PT-2026-72880
Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description The plugin is susceptible to account takeover because the add front user update AJAX handler is accessible to unauthenticated users. The handler accepts an arbitrary truebooker wp user id value an...
PT-2026-72146
Name of the Vulnerable Software and Affected Versions User Session Synchronizer versions prior to 1.4.1 Description An authentication bypass exists that can lead to account takeover. The synchronize session function, which executes on every request, fails to validate nonces, capabilities, or shar...
PT-2026-72140
Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where...
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...
Exploit for CVE-2026-12345
CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)
Last week, there were 294 vulnerabilities disclosed in 233 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 149 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...
CVE-2020-9373
creationtimestamp| type| source ---|---|--- 2026-08-14 13:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/98039 2026-08-15 00:00:47+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/98039 2026-08-15 08:00:04+00:00| seen|...
WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...
WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Quill Forms versions = 5.7.1...
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...
WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...
WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability
Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin Starter Templates by Kadence WP versions = 2.3.3...