🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our SQL Injection firewall rule

1,615,893

Attacks Blocked in Past 24 Hours

Showing 21-40 of 1,444 Vulnerabilities

PayPlus Payment Gateway <= 6.6.8 - Unauthenticated SQL Injection

10.0

CVE-2024-6205

Jun 28, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution

10.0

CVE-2024-37112

Jun 20, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection

10.0

CVE-2024-3605

Jun 19, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection

10.0

CVE-2024-3922

Jun 11, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

wpDataTables - Tables & Table Charts (Premium) <= 6.3.1 - Unauthenticated SQL Injection

10.0

CVE-2024-3820

May 31, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

HTML5 Video Player <= 2.5.26 - Unauthenticated SQL Injection

10.0

CVE-2024-5522

May 30, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Push Notification for Post and BuddyPress <= 1.93 - Unauthenticated SQL Injection

10.0

CVE-2024-6159

May 27, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

XStore Core <= 5.3.8 - Unauthenticated SQL Injection

10.0

CVE-2024-33551

Apr 25, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.10 - Unauthenticated SQL Injection

10.0

CVE-2024-33544

Apr 25, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

XStore <= 9.3.8 - Unauthenticated SQL Injection

10.0

CVE-2024-33559

Apr 25, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

WP-Recall – Registration, Profile, Commerce & More <= 16.26.5 - Unauthenticated SQL Injection

10.0

CVE-2024-32709

Apr 22, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Realtyna Organic IDX plugin <= 4.14.4 - Unauthenticated SQL Injection

10.0

CVE-2024-32128

Apr 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

WP Travel Engine <= 5.7.9 - Unauthenticated SQL Injection

10.0

CVE-2024-30502

Mar 28, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CRM Perks Forms <= 1.1.4 - Unauthenticated SQL Injection

10.0

CVE-2024-30498

Mar 28, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ProfileGrid <= 5.7.8 - Unauthenticated SQL Injection

10.0

CVE-2024-30490

Mar 28, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Viral Quiz Maker - OnionBuzz < 1.2.2 - SQL Injection

10.0

CVE-2019-14231

Jul 20, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Simple Ads Manager < 2.7.97 - Multiple SQL Injections

10.0

CVE-2015-2824

Apr 2, 2015

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

All-in-One Events Calendar < 1.10 - SQL Injection

10.0

CVE ID Unknown

Mar 7, 2013

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

FireStats <1.6.2 - SQL Injection

10.0

CVE-2009-2144

Jun 22, 2009

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection

9.9

CVE-2024-8621

Sep 24, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
PayPlus Payment Gateway <= 6.6.8 - Unauthenticated SQL Injection	CVE-2024-6205	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	June 28, 2024
WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution	CVE-2024-37112	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	June 20, 2024
WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection	CVE-2024-3605	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	June 19, 2024
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection	CVE-2024-3922	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	June 11, 2024
wpDataTables - Tables & Table Charts (Premium) <= 6.3.1 - Unauthenticated SQL Injection	CVE-2024-3820	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	May 31, 2024
HTML5 Video Player <= 2.5.26 - Unauthenticated SQL Injection	CVE-2024-5522	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	May 30, 2024
Push Notification for Post and BuddyPress <= 1.93 - Unauthenticated SQL Injection	CVE-2024-6159	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	May 27, 2024
XStore Core <= 5.3.8 - Unauthenticated SQL Injection	CVE-2024-33551	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	April 25, 2024
WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.10 - Unauthenticated SQL Injection	CVE-2024-33544	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	April 25, 2024
XStore <= 9.3.8 - Unauthenticated SQL Injection	CVE-2024-33559	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	April 25, 2024
WP-Recall – Registration, Profile, Commerce & More <= 16.26.5 - Unauthenticated SQL Injection	CVE-2024-32709	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	April 22, 2024
Realtyna Organic IDX plugin <= 4.14.4 - Unauthenticated SQL Injection	CVE-2024-32128	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	April 12, 2024
WP Travel Engine <= 5.7.9 - Unauthenticated SQL Injection	CVE-2024-30502	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	March 28, 2024
CRM Perks Forms <= 1.1.4 - Unauthenticated SQL Injection	CVE-2024-30498	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	March 28, 2024
ProfileGrid <= 5.7.8 - Unauthenticated SQL Injection	CVE-2024-30490	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	March 28, 2024
Viral Quiz Maker - OnionBuzz < 1.2.2 - SQL Injection	CVE-2019-14231	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	July 20, 2019
Simple Ads Manager < 2.7.97 - Multiple SQL Injections	CVE-2015-2824	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	April 2, 2015
All-in-One Events Calendar < 1.10 - SQL Injection		10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	March 7, 2013
FireStats <1.6.2 - SQL Injection	CVE-2009-2144	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	June 22, 2009
Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection	CVE-2024-8621	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	September 24, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation