As cited
Copy frozen at (site build).
vulnerabilities
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Wordfence disclosed 497 vulnerabilities across 327 WordPress plugins and 23 themes during October 12-18, 2026, with 428 patched and 69 unpatched. Critical flaws included unauthenticated remote code execution, SQL injection, and authentication bypass issues affecting popular extensions. Cross-site scripting represented the largest vulnerability class at 159 instances, followed by missing authorization at 116 instances.
Why it matters: WordPress site owners and administrators must immediately audit affected plugins and themes listed in this report and apply available patches, as 23 critical-severity vulnerabilities pose immediate threat of site compromise, account takeover, and data theft for unpatched installations.
- Source published
- First seen by Cybersecurity Tracker