Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

Wordfence Intelligence Weekly WordPress Vulnerability Report (January 12, 2026 to January 18, 2026)

🗓️ 22 Jan 2026 14:50:20Reported by Chloe ChamberlandType 
wordfence
 wordfence🔗 www.wordfence.com👁 41 Views

Wordfence reports 170 vulnerabilities in WordPress plugins and themes; bug bounties up to 31,200.

Related
ReporterTitlePublishedViews
Family
vulnrichment
Vulnrichment		CVE-2025-12984 Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection
17 Jan 202606:42
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-13062 Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass
15 Jan 202613:23
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-13627 Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting
14 Jan 202605:28
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-13725 Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter
17 Jan 202603:24
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-13859 AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings
15 Jan 202613:23
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-14001 WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
13 Jan 202611:21
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-14029 Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter
17 Jan 202604:34
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-14075 WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
17 Jan 202602:22
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-14078 PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation
17 Jan 202608:24
–vulnrichment
vulnrichment
Vulnrichment		CVE-2025-14173 Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
14 Jan 202606:40
–vulnrichment
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
22 Jan 2026 14:50Current
8.6High risk
Vulners AI Score8.6
CVSS 3.17.5 - 10
EPSS0.21054
SSVC
wordfence intelligencewordpress pluginswordpress themesbug bounty programvulnerability databasewebhook integrationvulnerability scannervulnerabilities last weekwordpress vulnerability reports
41