🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our SQL Injection firewall rule

1,458,445

Attacks Blocked in Past 24 Hours

Showing 621-640 of 1,444 Vulnerabilities

TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection

7.2

CVE-2022-3141

Jul 23, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Transposh WordPress Translation <= 1.0.8.1 - Authenticated (Admin+) SQL Injection via 'tp_editor'

7.2

CVE-2022-25811

Jul 22, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Homepage Product Organizer for WooCommerce <= 1.1 - Authenticated (Subscriber+) SQL Injection

8.8

CVE-2022-30998

Jul 19, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WPDating <= 7.4.0 - SQL Injection

9.8

CVE-2022-2460

Jul 18, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Website File Changes Monitor <= 1.8.2 - Authenticated (Admin+) SQL Injection

7.2

CVE-2022-2269

Jul 13, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Youzify <= 1.1.9 - SQL Injection

9.8

CVE-2022-1950

Jul 13, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Counter Box – WordPress plugin for countdown, timer, counter <= 1.2 - SQL Injection

7.2

CVE ID Unknown

Jul 8, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Social Share Buttons by Supsystic <= 2.2.6 - SQL Injection

9.8

CVE ID Unknown

Jul 6, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WP Visitor Statistics (Real Time Traffic) <= 5.7 - Unauthenticated SQL Injection

9.8

CVE-2022-33965

Jul 6, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQL Injection

9.8

CVE-2022-1057

Jun 16, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Premium Courses & eLearning <= 1.0.5 - SQL Injection

9.8

CVE ID Unknown

Jun 15, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Social Share Buttons by Supsystic <= 2.2.3 - Authenticated (Subscriber+) SQL Injection

8.8

CVE-2022-33960

Jun 9, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Contest Gallery – Files Upload and Contest Plugin for WordPress <= 17.0.4 - Admin+ SQL Injection

7.2

CVE ID Unknown

Jun 1, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Restaurant Reservations <= 1.7 - SQL Injection

6.4

CVE ID Unknown

May 31, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Better Find and Replace <= 1.3.5 - Admin+ SQL Injection

7.2

CVE-2022-1472

May 30, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Events Made Easy <= 2.2.80 - SQL Injection

9.8

CVE-2022-1905

May 27, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Envato Sales By Item <= 1.1 - Unauthenticated SQL Injection via AJAX call

6.5

CVE ID Unknown

May 26, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Gallery for Social Photo <= 1.0.0.25 - Subscriber+ SQL Injection

8.8

CVE ID Unknown

May 24, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Image Slider <= 1.1.119 - Subscriber+ SQL Injection

8.8

CVE ID Unknown

May 24, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KiviCare – Clinic & Patient Management System (EHR) <= 2.3.8 - SQL Injection

9.8

CVE-2022-0786

May 23, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection	CVE-2022-3141	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	July 23, 2022
Transposh WordPress Translation <= 1.0.8.1 - Authenticated (Admin+) SQL Injection via 'tp_editor'	CVE-2022-25811	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	July 22, 2022
Homepage Product Organizer for WooCommerce <= 1.1 - Authenticated (Subscriber+) SQL Injection	CVE-2022-30998	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	July 19, 2022
WPDating <= 7.4.0 - SQL Injection	CVE-2022-2460	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 18, 2022
Website File Changes Monitor <= 1.8.2 - Authenticated (Admin+) SQL Injection	CVE-2022-2269	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	July 13, 2022
Youzify <= 1.1.9 - SQL Injection	CVE-2022-1950	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 13, 2022
Counter Box – WordPress plugin for countdown, timer, counter <= 1.2 - SQL Injection		7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	July 8, 2022
Social Share Buttons by Supsystic <= 2.2.6 - SQL Injection		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 6, 2022
WP Visitor Statistics (Real Time Traffic) <= 5.7 - Unauthenticated SQL Injection	CVE-2022-33965	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 6, 2022
Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQL Injection	CVE-2022-1057	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 16, 2022
Premium Courses & eLearning <= 1.0.5 - SQL Injection		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 15, 2022
Social Share Buttons by Supsystic <= 2.2.3 - Authenticated (Subscriber+) SQL Injection	CVE-2022-33960	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	June 9, 2022
Contest Gallery – Files Upload and Contest Plugin for WordPress <= 17.0.4 - Admin+ SQL Injection		7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	June 1, 2022
Restaurant Reservations <= 1.7 - SQL Injection		6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	May 31, 2022
Better Find and Replace <= 1.3.5 - Admin+ SQL Injection	CVE-2022-1472	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	May 30, 2022
Events Made Easy <= 2.2.80 - SQL Injection	CVE-2022-1905	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 27, 2022
Envato Sales By Item <= 1.1 - Unauthenticated SQL Injection via AJAX call		6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	May 26, 2022
Gallery for Social Photo <= 1.0.0.25 - Subscriber+ SQL Injection		8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 24, 2022
Image Slider <= 1.1.119 - Subscriber+ SQL Injection		8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 24, 2022
KiviCare – Clinic & Patient Management System (EHR) <= 2.3.8 - SQL Injection	CVE-2022-0786	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 23, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation