Some links on this page are affiliate links. We may earn a commission when you click through and make a purchase, at no additional cost to you.
Between April 27 and May 3, 2026, the Wordfence Intelligence Vulnerability Database added 87 newly disclosed vulnerabilities affecting 198 WordPress plugins and 5 themes. This latest batch highlights the ongoing security challenges faced by the WordPress ecosystem and underscores the critical need for site owners to stay vigilant and up to date. With contributions from 61 distinct vulnerability researchers, the report reveals key threat patterns and provides actionable data to help protect WordPress sites.
Key Takeaways
- 87 vulnerabilities disclosed last week impacting 198 plugins and 5 themes, with 84 patched and 3 still unpatched.
- Cross-site scripting (XSS) remains the most common vulnerability type, followed by missing authorization and SQL injection.
- Wordfence deployed new firewall rules protecting Premium and paid users immediately; free users receive protection after 30 days.
- 61 security researchers contributed to the disclosures, emphasizing active community involvement in WordPress security.
- Site owners can leverage free Wordfence tools and APIs to continuously monitor and defend against new threats.
Vulnerability Landscape and Severity Breakdown
The 87 vulnerabilities reported last week were distributed across a broad range of plugins and themes, reflecting the diverse attack surface of the WordPress ecosystem. Out of these, 84 vulnerabilities had already been patched at the time of reporting, while 3 remained unpatched, posing immediate risks to sites using those components.
Severity ratings, as classified by the Common Vulnerability Scoring System (CVSS), show that 50 vulnerabilities were medium severity, 34 were high severity, and 3 were critical. Although critical vulnerabilities are fewer in number, they demand immediate attention due to their potential for severe impact such as remote code execution or full site takeover.
Most Common Vulnerability Types
Cross-site scripting (XSS) vulnerabilities, categorized as improper neutralization of input during web page generation, constituted 30 of the disclosed issues. XSS continues to be a prevalent threat because it allows attackers to inject malicious scripts that can steal user data or hijack sessions.
Following XSS, 19 vulnerabilities involved missing authorization, where plugins failed to properly verify user permissions before granting access to sensitive operations or data. This type of flaw can lead to privilege escalation or unauthorized data exposure.
SQL injection vulnerabilities were also notable, with 10 reported cases. SQL injection enables attackers to manipulate database queries, potentially exposing or corrupting site data. Other vulnerability types included exposure of sensitive information (6 cases), server-side request forgery (3 cases), and authentication bypass (2 cases), among others.
Wordfence Firewall Enhancements and Patch Deployment
The Wordfence Threat Intelligence Team carefully reviews each reported vulnerability to assess its impact and exploitability. Last week, the team deployed new firewall rules protecting against two significant vulnerabilities (WAF-RULE-909 and WAF-RULE-910), though details remain confidential while vendors work on patches.
These firewall rules were immediately rolled out to Wordfence Premium, Care, and Response customers, ensuring proactive defense. Free Wordfence users will receive these protections after a 30-day delay, reflecting the tiered approach to threat mitigation. This strategy balances rapid protection for paying customers with broad ecosystem security.
Community Contributions and Security Research
Sixty-one vulnerability researchers contributed to the WordPress security landscape last week, showcasing a diverse and engaged security community. Notable contributors included daroo and Luc Huynh from Noventiq RedTeam, each reporting 5 vulnerabilities, as well as Naoya Takahashi and Jakub Herman with 4 each.
Wordfence encourages security researchers to responsibly disclose vulnerabilities through their Bug Bounty Program, offering recognition and rewards. This ongoing collaboration is vital for maintaining the health and safety of WordPress sites worldwide.
Plugins with Reported Vulnerabilities
The vulnerabilities span a wide variety of popular and niche plugins, including Advanced Classifieds & Directory Pro, Advanced Scrollbar, AI Bud – AI Content Generator, and AFI – The Easiest Integration Plugin. This diversity illustrates that no plugin category is immune from security risks, making regular vulnerability assessments essential.
What This Means for WordPress Users
For most WordPress sites, this weekly influx of vulnerabilities serves as a reminder that plugin and theme security cannot be an afterthought. Site owners and agency operators must implement layered defense strategies that include timely updates, vulnerability scanning, and firewall protections.
Our testing shows that leveraging tools like the Wordfence CLI Vulnerability Scanner and the vulnerability API can provide real-time insight into emerging threats and help prioritize patching efforts. Integrating such tools into routine maintenance workflows improves overall site resilience.
From a developer perspective, plugin authors should adopt secure coding practices to prevent common vulnerabilities like XSS and SQL injection, which remain dominant threat vectors. The rise in missing authorization issues highlights the need for rigorous access control checks.
For managed WordPress hosts and enterprises, this report underlines the value of proactive vulnerability management and threat intelligence integration. Hosting providers can enhance their offerings by embedding Wordfence’s API and firewall protections, offering customers peace of mind.
Frequently Asked Questions
How can I check if my WordPress site is affected by these vulnerabilities?
You can use the free Wordfence CLI Vulnerability Scanner or access the Wordfence Intelligence Vulnerability Database API to scan your site’s plugins and themes against the latest known vulnerabilities. Regular scanning helps identify risks early.
What should I do if a plugin I use has an unpatched vulnerability?
Immediately monitor the plugin’s updates and consider disabling it temporarily if the vulnerability poses a high risk. Employ Wordfence firewall rules if available and follow vendor advisories until a patch is released.
Are free Wordfence users protected against new vulnerabilities?
Yes, but with a delay. Wordfence deploys firewall protections to free users 30 days after premium users receive them, providing a safety net while encouraging upgrades for faster protection.
How does Wordfence’s Bug Bounty Program benefit WordPress security?
The program incentivizes security researchers to responsibly disclose vulnerabilities to Wordfence, enabling timely patching and community-wide protection, while offering recognition and rewards to contributors.
