Wordfence Intelligence Reports 240 WordPress Vulnerabilities in One Week

Wordfence Intelligence has released its latest weekly vulnerability report, detailing a substantial number of security flaws discovered in WordPress plugins and themes between August 17 and August 23, 2026. The report identifies a total of 240 vulnerabilities affecting 184 distinct WordPress plugins and 17 themes. This influx of vulnerabilities underscores the ongoing security challenges within the vast WordPress ecosystem, which powers a significant portion of the internet.

The majority of the disclosed vulnerabilities were classified as high or critical in severity, indicating a serious risk to websites running the affected software. Cross-Site Scripting (XSS) and Missing Authorization were identified as the most prevalent Common Weakness Enumeration (CWE) types, accounting for a significant portion of the total flaws. XSS vulnerabilities can allow attackers to inject malicious scripts into web pages viewed by other users, while Missing Authorization flaws can permit unauthorized access to sensitive functionalities or data.

In response to these findings, the Wordfence Threat Intelligence Team has deployed real-time firewall rules to protect its Premium, Care, and Response customers against one undisclosed vulnerability. This protection was immediately available to these customers, while users of the free Wordfence version will receive the same protection after a 30-day delay, a common practice to allow vendors time to patch.

Of the 240 vulnerabilities reported, 166 have already been patched by their respective developers, leaving 74 still unpatched. The severity breakdown shows 111 vulnerabilities rated as Medium, 112 as High, and 17 as Critical. This distribution highlights the critical need for users to stay vigilant and update their plugins and themes promptly to mitigate potential risks.

Beyond the technical details of the vulnerabilities, the report also acknowledges the 105 vulnerability researchers who contributed to WordPress security during that week. Wordfence emphasizes its commitment to making vulnerability information accessible through its free Wordfence Intelligence platform, including its vulnerability database, API, and CLI scanner, aiming to empower users with the knowledge needed for robust security practices.

The data presented in this report serves as a stark reminder of the continuous effort required to maintain the security of WordPress websites. With new vulnerabilities being discovered and disclosed regularly, website administrators must prioritize regular security audits, timely updates, and the use of reputable security solutions like the Wordfence Firewall to defend against evolving threats.

Wordfence continues to monitor the WordPress security landscape, providing timely updates and protection mechanisms. The organization encourages responsible disclosure of vulnerabilities and highlights the importance of a layered security approach, aligning with its mission of securing WordPress through defense-in-depth strategies.