CVE Program partner

Wordfence

Wordfence

API
CVEs, 365 days4,49412,033 all time, 305 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationWordfence
RoleCNA
TypeVendor, Researcher
Reports tomitre
ScopeWordPress Plugins, Themes, and Core Vulnerabilities discovered by, or reported to, the Wordfence/Defiant team.
Advisorieshttps://www.wordfence.com/blog/category/vulnerabilities/

Latest CVEs · RSS

  • CVE-2026-110253 2026-10-17 · CVSS 5.4
    The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file pat
  • CVE-2026-100316 2026-10-17 · CVSS 7.2
    The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions
  • CVE-2026-109983 2026-10-17 · CVSS 6.4
    The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including,
  • CVE-2026-111110 2026-10-17 · CVSS 7.2
    The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' para
  • CVE-2026-92798 2026-10-17 · CVSS 8.1
    The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to in
  • CVE-2026-103899 2026-10-17 · CVSS 7.2
    The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and
  • CVE-2026-109989 2026-10-17 · CVSS 6.4
    The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1
  • CVE-2026-107744 2026-10-17 · CVSS 6.5
    The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i
  • CVE-2026-111726 2026-10-17 · CVSS 6.4
    The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.
  • CVE-2026-108123 2026-10-17 · CVSS 7.5
    The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to
  • CVE-2026-92978 2026-10-17 · CVSS 4.3
    The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin
  • CVE-2026-109369 2026-10-17 · CVSS 6.8
    The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to
  • CVE-2026-96660 2026-10-17 · CVSS 7.2
    The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin
  • CVE-2026-104736 2026-10-17 · CVSS 9.8
    The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from t
  • CVE-2026-109368 2026-10-17 · CVSS 6.5
    The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via
  • CVE-2026-92715 2026-10-17 · CVSS 4.3
    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including
  • CVE-2026-107752 2026-10-17 · CVSS 4.9
    The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter
  • CVE-2026-109985 2026-10-17 · CVSS 6.4
    The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' paramet
  • CVE-2026-110268 2026-10-17 · CVSS 4.9
    The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' pa
  • CVE-2026-111602 2026-10-17 · CVSS 3.7
    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver
  • CVE-2026-110653 2026-10-17 · CVSS 9.1
    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition
  • CVE-2026-109208 2026-10-17 · CVSS 7.2
    The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (RE
  • CVE-2026-111601 2026-10-17 · CVSS 6.1
    The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, a
  • CVE-2026-104734 2026-10-17 · CVSS 7.2
    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,
  • CVE-2026-107762 2026-10-17 · CVSS 7.5
    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an

All CVE Program partners