Wordfence: 319 WordPress Plugin Vulnerabilities in a Week
Wordfence's latest report recorded 319 WordPress plugin vulnerabilities across 222 plugins between September 21 and 27, 2026, and 156 security researchers contributed findings that week. These vulnerabilities have been added to the Wordfence Intelligence Vulnerability Database, which is free to query through its web interface, through an API (a way for software to request data automatically), and through webhook notifications (real-time alerts sent to another system). The database contains more than 40,000 WordPress vulnerability records, and Wordfence says its mission is to make that data accessible so site owners, hosting providers and enterprises can apply layered security, also called defense in depth.
Of the 319 vulnerabilities, 306 already have patches available from their plugin authors, while 13 remain unpatched at the time of the report. Using the Common Vulnerability Scoring System (CVSS, a standard 0 to 10 scale for rating security flaws), Wordfence classified 226 as medium severity, 79 as high severity, and 14 as critical severity. The most common weakness type was cross-site scripting (XSS), where an attacker can inject malicious script into a page viewed by others, with 96 instances. Missing authorization accounted for 59, authorization bypass through a user-controlled key for 26, SQL injection (manipulating database queries) for 24, and exposure of sensitive information to an unauthorized actor for 22. Other notable weakness types included improper privilege management (14), deserialization of untrusted data (11), path traversal (11), code injection (8), server-side request forgery (7), and cross-site request forgery (4).
The report also covers a vulnerability in WordPress Core version 7.1.1 and earlier: an unauthenticated local file inclusion via the locate_template() function's path traversal. Local file inclusion lets an attacker trick a web application into loading a file from the server that should not be exposed, potentially reading sensitive configuration or source code. Wordfence's Threat Intelligence Team, which reviews each vulnerability to determine impact and severity and to verify that the Wordfence Firewall provides sufficient protection, deployed three new firewall rules last week. These are identified as WAF-RULE-959, WAF-RULE-960 and WAF-RULE-961, but their details are redacted while Wordfence works with the affected vendors on patches. Customers using Wordfence Premium, Care or Response received that protection immediately, while free Wordfence users will receive the same enhanced protection after a 30-day delay. The WordPress Core local file inclusion flaw was also protected immediately for Premium, Care and Response customers.
The 222 affected plugins span nearly every part of the WordPress ecosystem. Page builders and their add-ons include Elementor, ElementsKit, Premium Addons for Elementor, HappyAddons for Elementor, King Addons, JetEngine and JetTricks. E-commerce and donation plugins listed include GiveWP, SureCart, Easy Digital Downloads, Payment Plugins for PayPal WooCommerce, Paymob for WooCommerce, Razorpay Payment Button, and several WooCommerce product filter and feed plugins. Form builders affected include Ninja Forms, Forminator, JetFormBuilder, Happyforms and HT Contact Form. Caching and image optimization tools such as 10Web Booster, Asset CleanUp: Page Speed Booster, Core Web Vitals & PageSpeed Booster, Optimole and ShortPixel Image Optimizer are on the list. Security tools like All-In-One Security (AIOS), Malcure Malware Shield, SSL Zen and Easy Hide Login also appear, as do gallery plugins like NextGEN Gallery and Modula, membership plugins like s2Member and Paid Membership Subscriptions, booking plugins like Booking Calendar and Bookly, and many others. The full list is available in the Wordfence report.
Among the 156 researchers who contributed, Ananda Dhakal reported the most with 34 vulnerabilities, followed by Karthik Ramakrishnan and Intrudify with 11 each. Eight researchers each reported 8 vulnerabilities: vuxvinh, Jakub Herman, Artus KG, Wordfence PRISM and nh4tvd are among them. Dozens of other researchers reported one or two findings. Wordfence encourages responsible disclosure through its Bug Bounty Program, which offers bounties for in-scope vulnerabilities and lists researchers on a public leaderboard.
For site owners, the volume of plugin vulnerabilities is a reminder that the WordPress ecosystem changes constantly. Because more than 300 vulnerabilities were patched in a single week, applying plugin updates quickly is one of the most effective protections. The 13 unpatched flaws and the WordPress Core local file inclusion issue mean that some sites remain exposed until developers release fixes or users apply workarounds. A managed WordPress host such as AEU Hosting can reduce that workload with automatic backups, security hardening and timely updates, although no host can replace the need to keep every installed plugin up to date and remove unused ones.