Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
Wordfence's weekly report for October 5–11, 2026, added 655 vulnerabilities across 406 plugins and 100 themes, with contributions from 236 researchers. Of these, 21 were critical, 249 high, 377 medium, and 8 low; 366 were patched and 289 remained unpatched. Highlighted issues include unauthenticated stored cross-site scripting in WordPress Core 7.1 through 7.1.2 via pending comments, and unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce 10.8.0 and earlier. Premium firewall rules were deployed immediately, while free Wordfence users receive them after 30 days.
58