Wordfence PRISM

Wordfence PRISM is a security researcher credited with 355 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #22 of 3,866 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 127 of their findings (36%). Other recurring categories include SQL Injection, Missing Authorization. The average CVSS score across these disclosures is 6.2, peaking at 9.8. Severity breakdown: 7 critical and 62 high.

The most affected software includes Eventin (7), Cozy Blocks (6), Groundhogg (6), across 218 distinct plugins, themes and core versions in total.

348 of the 355 disclosed issues have a vendor fix, while 7 remain unpatched. The most severe finding, "LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#22

of 3,866 researchers

Vulns

355

Critical7

High62

Medium284

Low2

Affected Assets

218

218plugins

Avg CVSS

6.2

Average score of vulnerabilities

Researcher Submissions

355 records


2026-10-23 21:31	aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute aBlocks <= 2.17.0	`CVE-2026-110018`	8.8 High	Wordfence PRISM	Yes
2026-10-16 19:36	YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter YMC Filter <= 3.12.19	`CVE-2026-109983`	6.4 Medium	Wordfence PRISM	Yes
2026-10-16 14:43	xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter xSpeed Cache <= 1.4.2	`CVE-2026-109985`	6.4 Medium	Wordfence PRISM	Yes
2026-10-16 14:43	Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter Post Export Import with Media <= 1.17.2	`CVE-2026-110268`	4.9 Medium	Wordfence PRISM	Yes
2026-10-16 14:39	WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse WP Booking System <= 2.1.0.3	`CVE-2026-109369`	6.8 Medium	Wordfence PRISM	Yes
2026-10-16 14:38	WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action WP Booking System <= 2.1.0.3	`CVE-2026-109368`	6.5 Medium	Wordfence PRISM	Yes
2026-10-16 14:38	WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action WP Booking System <= 2.1.0.3	`CVE-2026-108123`	7.5 High	Wordfence PRISM	Yes
2026-10-16 14:36	Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter Themify Popup <= 1.4.7	`CVE-2026-109989`	6.4 Medium	Wordfence PRISM	Yes
2026-10-16 14:35	Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute Themify Builder <= 7.8.2	`CVE-2026-111726`	6.4 Medium	Wordfence PRISM	Yes
2026-10-16 14:35	Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie Welcart e-Commerce <= 2.12.4	`CVE-2026-107752`	4.9 Medium	Wordfence PRISM	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 355 records. Every record has its own page and is listed in the sitemap.