Wordfence Intelligence’s latest weekly WordPress vulnerability report shows a busy seven days for the ecosystem, with 655 vulnerabilities disclosed across 406 plugins and 100 themes between October 5, 2026 and October 11, 2026. Wordfence says 236 vulnerability researchers contributed to WordPress security during the week, while its team also pushed new firewall rules for two issues it judged important enough to protect against immediately for paid customers.
Wordfence Intelligence counts 655 new issues in one week
The report is a snapshot of the public vulnerability landscape tracked in the Wordfence Intelligence Vulnerability Database. Wordfence says last week’s disclosures were added to the database so site owners, developers, hosting providers, and enterprises can review exposure and take action before attackers do.
According to the report, 366 of the vulnerabilities were patched and 289 remained unpatched at the time of publication. Wordfence also notes that its database now holds more than 40,000 vulnerabilities, and that its user interface, database API, and webhook integration are available free for personal and commercial use.
The company presents the report as part of its broader defense-in-depth approach to WordPress security, aimed at helping site owners monitor issues as they are disclosed and updated. It also encourages researchers to responsibly disclose findings through its bug bounty program.
Firewall protection was added for two specific vulnerabilities
Wordfence’s Threat Intelligence Team reviewed each issue for impact, severity, and the likelihood of exploitation before deciding whether the firewall needed additional rules. Last week, the team deployed enhanced protection in real time for Premium, Care, and Response customers against two vulnerabilities:
- WordPress Core 7.1 – 7.1.2 — Unauthenticated Stored Cross-Site Scripting via Pending Comments
- Abandoned Cart Pro for WooCommerce <= 10.8.0 — Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Users of the free version of Wordfence will receive the same enhanced protection after a 30-day delay, according to the report.
Why those two stood out
The first issue affects WordPress Core and involves unauthenticated stored cross-site scripting, which can be especially concerning because it targets the core platform itself rather than a third-party extension. The second issue affects a WooCommerce-related plugin and involves unauthenticated SQL injection, a class of flaw that can create serious database exposure if not mitigated quickly.
Wordfence did not provide additional technical exploitation details in the weekly summary, but the inclusion of both issues in the firewall rollout indicates the company believed they warranted immediate defensive coverage.
Severity trends skewed toward medium and high risk
Of the 655 vulnerabilities reported last week, the severity breakdown leaned heavily toward medium and high risk issues. The report lists 377 medium-severity vulnerabilities, 249 high-severity vulnerabilities, 21 critical vulnerabilities, and 8 low-severity vulnerabilities.
That distribution matters because even when a flaw is not categorized as critical, it can still create real-world risk for busy sites that delay updates. In WordPress environments, a medium-severity plugin issue can be just as operationally disruptive as a more severe bug if it is deployed widely or left unpatched for long enough.
Severity at a glance
- Low severity: 8
- Medium severity: 377
- High severity: 249
- Critical severity: 21
Cross-site scripting remained the most common flaw type
Wordfence’s breakdown by CWE shows that cross-site scripting was the most frequently reported class of vulnerability, with 198 instances. Missing authorization followed with 112, while deserialization of untrusted data accounted for 67 and SQL injection for 61.
Other notable categories included exposure of sensitive information to an unauthorized actor, improper privilege management, PHP remote file inclusion, authorization bypass through user-controlled key, and unrestricted file upload. The spread suggests that the ecosystem continues to struggle with a familiar mix of input handling, access control, and data exposure problems.
Top vulnerability classes reported last week
- Cross-site scripting: 198
- Missing authorization: 112
- Deserialization of untrusted data: 67
- SQL injection: 61
- Exposure of sensitive information to an unauthorized actor: 45
- Improper privilege management: 30
- PHP remote file inclusion: 24
- Authorization bypass through user-controlled key: 21
- Unrestricted file upload: 18
- Path traversal: 15
Wordfence also lists smaller numbers of issues in categories such as code injection, improper authentication, CSRF, SSRF, race conditions, infinite loops, and sensitive data leakage in sent data. While each individual figure is small in this weekly snapshot, together they underline how wide the attack surface remains across the WordPress plugin and theme ecosystem.
Researchers behind the disclosures
The report credits 236 vulnerability researchers for last week’s findings. At the top of the leaderboard were Ananda Dhakal with 61 vulnerabilities, João Pedro S Alcântara with 42, Bonds with 26, Wordfence PRISM with 26, and Naoki Kawahigashi with 19.
Other notable contributors included Tran Nguyen Bao Khanh, Intrudify, Enrico Marcolini, johska, Peter Tang, and Karthik Ramakrishnan. Wordfence says researchers who responsibly disclose findings can earn a bounty on in-scope vulnerabilities and be featured in its weekly report and leaderboard.
Leading contributors by volume
- Ananda Dhakal — 61
- João Pedro S Alcântara — 42
- Bonds — 26
- Wordfence PRISM — 26
- Naoki Kawahigashi — 19
A long list of affected plugins underscores the scale of the problem
The report includes an extensive list of WordPress plugins with reported vulnerabilities, ranging from security and backup tools to form builders, booking systems, page builders, gallery plugins, membership software, and WooCommerce extensions. Among the names appearing in the weekly report are Jetpack, Rank Math SEO, Fluent Forms, Elementor-related add-ons, WooCommerce utilities, LMS platforms, and several directory and booking plugins.
That breadth is a reminder that vulnerability management is not just a concern for niche software. Popular, widely deployed plugins can accumulate issues quickly simply because they are used at scale and by many different development teams.
For site owners, the practical takeaway is straightforward: review installed plugins and themes, remove software that is no longer needed, and update affected components promptly. Where immediate patching is not possible, Wordfence’s paid firewall rules may provide extra time to respond.
What site owners should do now
Wordfence’s weekly report is not just a roll call of newly disclosed bugs; it is also a reminder that WordPress security depends on continuous maintenance. The fastest path to reducing risk is to identify whether any installed themes or plugins appear in the report and then verify whether updates are available.
For teams managing multiple sites, the Wordfence Intelligence API and webhook integration can help automate monitoring, while the weekly report offers a readable summary of what changed. Given the pace of disclosures, staying current is less a best practice than a necessity.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: October 16, 2026 at 10:34 pm
1 views
