Wordfence PRISM

Wordfence PRISM is a security researcher credited with 223 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #36 of 3,501 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 86 of their findings (39%). Other recurring categories include SQL Injection, Missing Authorization. The average CVSS score across these disclosures is 6.1, peaking at 9.8. Severity breakdown: 4 critical and 31 high.

The most affected software includes Cozy Blocks (6), WPBot (5), Groundhogg (4), across 146 distinct plugins, themes and core versions in total.

219 of the 223 disclosed issues have a vendor fix, while 4 remain unpatched. The most severe finding, "Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - 10.8.8 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#36

of 3,501 researchers

Vulns

246

Critical4

High36

Medium206

Low0

Affected Assets

156

156plugins

Avg CVSS

6.1

Average score of vulnerabilities

Researcher Submissions

223 records


2026-09-04 19:50	Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute Pods <= 3.3.9.1	`CVE-2026-76573`	6.4 Medium	Wordfence PRISM	Yes
2026-09-04 00:00	Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters Custom Contact Forms <= 7.16	`CVE-2026-75018`	4.3 Medium	Wordfence PRISM	Yes
2026-08-31 20:54	Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode Live Composer <= 2.1.19	`CVE-2026-16786`	6.4 Medium	Wordfence PRISM	Yes
2026-08-31 20:53	Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode Live Composer <= 2.1.19	`CVE-2026-16788`	6.4 Medium	Wordfence PRISM	Yes
2026-08-31 17:04	User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter User Profile Builder <= 4.0.0	`CVE-2026-75964`	6.1 Medium	Wordfence PRISM	Yes
2026-08-31 17:03	Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute Charitable <= 1.8.12.1	`CVE-2026-77189`	6.5 Medium	Wordfence PRISM	Yes
2026-08-31 17:02	BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content BetterDocs <= 4.8.1	`CVE-2026-75980`	6.4 Medium	Wordfence PRISM	Yes
2026-08-31 16:02	User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute User Profile Builder <= 4.0.0	`CVE-2026-75965`	6.4 Medium	Wordfence PRISM	Yes
2026-08-31 15:59	Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter Shopping Cart & eCommerce Store <= 5.9.2	`CVE-2026-17589`	4.9 Medium	Wordfence PRISM	Yes
2026-08-31 15:59	Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter Cozy Blocks <= 2.2.17	`CVE-2026-19948`	5.3 Medium	Wordfence PRISM	Yes

Showing 1–10 of 223 reports