Threat Log

Nothing in the entire threat log matches that search. Try a shorter term, for example just the product name or the CVE number.

1. For the record Wordfence

   AI Engine – The Chatbot, AI Framework & MCP for WordPress

   CVE-2026-15988

   Affects you if you run the AI Engine plugin in versions up to and including 3.6.5.

   An attacker can trick an administrator of your site into clicking a crafted link. If they do, a new administrator account with attacker-supplied credentials is created without their knowledge. The vulnerability exists because a security check, the nonce, is missing from a specific function. On its own, this is a classic Cross-Site Request Forgery. Combined with how WordPress processes REST requests, it becomes full privilege escalation.

   The attack requires an action by the administrator. That makes it less likely than a vulnerability requiring no interaction, but not harmless. A targeted link in a seemingly legitimate email is enough.

   Update the plugin to version 3.6.6. Then check your user list for unknown administrator accounts.

   Affected

   AI Engine – The Chatbot, AI Framework & MCP for WordPress

   Fixed in

   3.6.6

   CVSS

   8.8
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.22 %
   percentile 12.2

   Type

   CWE-352

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

2. For the record Wordfence

   Fluent Forms

   CVE-2026-17571

   Affects you if you run Fluent Forms up to and including 6.2.8.

   An attacker can place malicious code in the display if they can trick someone into clicking a crafted link. No login is required. The attack is limited to the browser of the person who clicks and runs in the context of your own site. That makes it less sweeping than a vulnerability that works without interaction, but it is not harmless.

   Update to 6.2.9.

   Affected

   Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

   Fixed in

   6.2.9

   CVSS

   6.1
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.21 %
   percentile 11.5

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

3. For the record Wordfence

   Kadence Blocks

   CVE-2026-18062

   Affects you if you run Kadence Blocks up to and including 3.7.8.1 and allow users with contributor-level access or higher to create posts.

   A stored cross-site scripting vulnerability in the Identity Block. An attacker with contributor access can place scripts that execute whenever someone visits the page. The attack requires the urlTransparent attribute to be set on the block. Without that value, the vulnerable code path is never reached.

   The hole is not exploitable from the outside, but contributor accounts are common in editorial teams and multi-user client projects. Kadence Blocks is widely deployed, so I am including it.

   Update Kadence Blocks to 3.7.8.2.

   Affected

   Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

   Fixed in

   3.7.8.2

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.21 %
   percentile 10.8

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

4. For the record Wordfence

   SureForms

   CVE-2026-7623

   Affects you if you run the SureForms plugin in versions up to and including 2.8.1 on your WordPress site and users with the Contributor role or higher exist.

   Stored cross-site scripting via a block attribute. An attacker with a Contributor account can plant scripts that execute whenever someone visits the page. The hurdle is the account, but the Contributor role is often handed to guest authors without the same scrutiny as an administrator.

   Update to version 2.8.2.

   Affected

   SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

   Fixed in

   2.8.2

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.21 %
   percentile 10.8

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

5. For the record Wordfence

   Powerkit

   CVE-2026-15644

   Affects you if you run the Powerkit plugin in a version up to and including 3.1.0 and your WordPress site has users with the Contributor role or higher.

   An attacker with a Contributor account can plant malicious scripts on a page via the 'style' shortcode attribute. When another user visits that page, the script executes in their browser. That is enough to hijack sessions or trick administrators into actions they did not intend.

   The vulnerability is not on the KEV catalog of actively exploited flaws. It requires an account, but the bar is low: Contributor is the role you give a guest author so they can submit a draft.

   Update Powerkit to version 3.1.1.

   Affected

   Powerkit – Supercharge your WordPress Site

   Fixed in

   3.1.1

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.21 %
   percentile 10.8

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

6. For the record Wordfence

   Powerkit

   CVE-2026-15645

   Affects you if you run the Powerkit plugin in a version up to and including 3.1.0 and people with the Contributor role or higher have access to your site.

   An attacker with an account of at least the Contributor role can place a script via the nav shortcode attribute. The script executes in the browser of every visitor who loads a page containing that shortcode. The damage depends on what the attacker does with the script, but the door is open.

   The vulnerability is not listed in the KEV catalog of actively exploited vulnerabilities. That is a snapshot, not a guarantee that it is not being exploited somewhere.

   Update Powerkit to version 3.1.1.

   Affected

   Powerkit – Supercharge your WordPress Site

   Fixed in

   3.1.1

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.21 %
   percentile 10.8

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

7. For the record Wordfence

   GamiPress

   CVE-2026-16091

   Affects you if you run GamiPress up to and including version 7.9.9.1 and have users with at least a contributor account.

   A stored cross-site scripting vulnerability in the gamipress_rank shortcode. An authenticated attacker with contributor-level access or higher can store scripts that execute in the browser of anyone visiting the affected page.

   On its own the vulnerability is medium severity because an account is required. On many WordPress installations the contributor hurdle is low, however, and combined with another vulnerability that provides an account, medium turns critical fast. That is why it is listed here.

   Update GamiPress to version 7.9.9.2. The source does not name another fix.

   Affected

   GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

   Fixed in

   7.9.9.2

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.20 %
   percentile 10.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

8. For the record Wordfence

   Powerkit – Supercharge your WordPress Site

   CVE-2026-15649

   Affects you if you run the Powerkit plugin in a version up to and including 3.1.0 and have users with the Contributor role or higher whom you do not trust completely.

   A Contributor can place stored JavaScript on a page via shortcode attributes. As soon as someone visits that page, the script runs in the visitor's browser. The attacker needs an account, but only the low-level Contributor role. No active exploitation in the wild is currently known, but the vulnerability is publicly documented.

   Update Powerkit to version 3.1.1. The source does not name a workaround that prevents the injection without the update.

   Affected

   Powerkit – Supercharge your WordPress Site

   Fixed in

   3.1.1

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.20 %
   percentile 10.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

9. For the record Wordfence

   GamiPress

   CVE-2026-16090

   Affects you if you run GamiPress up to and including version 7.9.9.1 and users with the Contributor role or higher have access to your site.

   A stored cross-site scripting vulnerability in the gamipress_achievement shortcode. An authenticated user with at least Contributor privileges can place scripts that execute whenever someone accesses the tampered page. WordPress's built-in filtering does not catch this because the value sits inside a shortcode attribute rather than as a raw HTML tag.

   Update to the next available version after 7.9.9.1. If no update has been released yet, deactivate the plugin until the vendor provides a fix.

   Affected

   GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

   Fixed in

   7.9.9.2

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.19 %
   percentile 9.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

10. For the record Wordfence

    Easy Property Listings

    CVE-2026-16684

    Affects you if you run Easy Property Listings up to and including version 3.5.24 and hand out accounts with subscriber-level access or higher, including to strangers.

    An attacker with their own account, even just a subscriber, can place a script in the Facebook contact method field. The plugin does not sanitize that input enough. When someone visits a page that displays this field, the script runs in the visitor's browser. What the attacker does with that depends on their script, but the door is open.

    Update to version 3.5.25. The source does not name a workaround that secures the field while the update is not applied.

    Affected

    Easy Property Listings

    Fixed in

    3.5.25

    CVSS

    6.4
    source security@wordfence.com

    Login required

    yes, user account

    Likely to be exploited

    0.19 %
    percentile 9.2

    Type

    CWE-79

    Actively exploited

    not on the KEV list

    Published

    2026-07-31

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.