WordPress.org vulnerabilities

Products

• Two Factor 1

Latest WordPress.org CVEs

Newest publication first

1. CVE-2026-100508 WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability

   Published 2026-09-30

   Medium·CVSS 5.3

   Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.