Filtered by tag: vulnerability report × Clear
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Matched: WordPress
Wordfence reported 319 WordPress vulnerabilities across 222 plugins for the week of September 21–27, 2026. Of these, 305 were patched and 14 remain unpatched. Fourteen vulnerabilities were rated critical, including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws. WordPress core itself received a patch for an unauthenticated local file inclusion bug. Cross-site scripting and missing authorization were the most common vulnerability types. 156 researchers contributed disclosures.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Matched: WordPress
Wordfence disclosed 277 WordPress vulnerabilities across 187 plugins and 7 themes for the week of August 31–September 6, 2026. Sixteen were critical (CVSS 9.8), including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws in plugins like Hummingbird, JetFormBuilder, Mail Mint, and MemberDash. Most vulnerabilities were patched; 23 remain unpatched. Cross-site scripting and missing authorization were the most common vulnerability types.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)
Matched: WordPress
Wordfence reported 240 WordPress vulnerabilities across 184 plugins and 17 themes for the week of August 17–23, 2026. Of these, 166 were patched and 74 remain unpatched. Seventeen critical-severity flaws were identified, including unauthenticated remote code execution in Broken Link Checker, JetEngine, and WP Compress, and unauthenticated file upload vulnerabilities in Elementor Pro, Forminator Forms, and Masteriyo LMS. Cross-site scripting and missing authorization were the most common vulnerability types. 105 researchers contributed disclosures.