🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our SQL Injection firewall rule

1,463,720

Attacks Blocked in Past 24 Hours

Showing 761-780 of 1,444 Vulnerabilities

WP Data Access <= 4.3.1 - Admin+ SQL Injection

7.2

CVE-2021-24866

Nov 8, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injection

9.8

CVE-2021-24931

Nov 8, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Registrations for the Events Calendar <= 2.7.5 - Unauthenticated SQL Injection

9.8

CVE-2021-24943

Nov 8, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

BSK PDF Manager <= 3.1.1 - Admin+ SQL Injection

7.2

CVE-2021-24860

Nov 1, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.2 - Subscriber+ SQL Injection

8.8

CVE-2021-24755

Nov 1, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Email Before Download <= 6.7 - Admin+ SQL Injection

7.2

CVE-2021-24748

Nov 1, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

uListing <= 1.6.6 - Unauthenticated SQL Injection

9.8

CVE-2021-4340

Oct 28, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection

7.2

CVE-2021-24889

Oct 26, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

MainWP Child <= 4.1.7.1 - SQL Injection via orderby, order Parameters

7.2

CVE-2021-24877

Oct 25, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter

7.2

CVE-2021-24786

Oct 20, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Duplicate Post WordPress Plugin <= 1.1.9 - SQL Injection

6.5

CVE-2021-43408

Oct 19, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Mangboard <= 1.9.9 - SQL Injection

7.5

CVE-2021-26609

Oct 19, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Email Log <= 2.4.6 - Admin+ SQL Injection

7.2

CVE-2021-24758

Oct 18, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SEO Redirection <= 8.1 - Subscriber+ SQL Injection

8.8

CVE-2021-24847

Oct 18, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Stream <= 3.8.1 - Admin+ SQL Injection

7.2

CVE-2021-24772

Oct 18, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Speed Booster Pack <= 4.3.3 - Admin+ SQL Injection

7.2

CVE-2021-25023

Oct 16, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

WP Fastest Cache < 0.9.5 - Authenticated (Subscriber+) SQL Injection

8.8

CVE-2021-24869

Oct 14, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WP Cloudy <= 4.4.9 - Authenticated (Admin+) SQL Injection

8.8

CVE-2021-24864

Oct 13, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Header Footer Code Manager <= 1.1.13 - Authenticated SQL Injections

7.2

CVE-2021-24791

Oct 11, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Asgaros Forum <= 1.15.12 - Unauthenticated SQL Injection

9.8

CVE-2021-24827

Oct 11, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
WP Data Access <= 4.3.1 - Admin+ SQL Injection	CVE-2021-24866	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 8, 2021
Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injection	CVE-2021-24931	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 8, 2021
Registrations for the Events Calendar <= 2.7.5 - Unauthenticated SQL Injection	CVE-2021-24943	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	November 8, 2021
BSK PDF Manager <= 3.1.1 - Admin+ SQL Injection	CVE-2021-24860	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 1, 2021
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.2 - Subscriber+ SQL Injection	CVE-2021-24755	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	November 1, 2021
Email Before Download <= 6.7 - Admin+ SQL Injection	CVE-2021-24748	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	November 1, 2021
uListing <= 1.6.6 - Unauthenticated SQL Injection	CVE-2021-4340	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	October 28, 2021
Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection	CVE-2021-24889	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	October 26, 2021
MainWP Child <= 4.1.7.1 - SQL Injection via orderby, order Parameters	CVE-2021-24877	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	October 25, 2021
Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter	CVE-2021-24786	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	October 20, 2021
Duplicate Post WordPress Plugin <= 1.1.9 - SQL Injection	CVE-2021-43408	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	October 19, 2021
Mangboard <= 1.9.9 - SQL Injection	CVE-2021-26609	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	October 19, 2021
Email Log <= 2.4.6 - Admin+ SQL Injection	CVE-2021-24758	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	October 18, 2021
SEO Redirection <= 8.1 - Subscriber+ SQL Injection	CVE-2021-24847	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	October 18, 2021
Stream <= 3.8.1 - Admin+ SQL Injection	CVE-2021-24772	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	October 18, 2021
Speed Booster Pack <= 4.3.3 - Admin+ SQL Injection	CVE-2021-25023	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	October 16, 2021
WP Fastest Cache < 0.9.5 - Authenticated (Subscriber+) SQL Injection	CVE-2021-24869	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	October 14, 2021
WP Cloudy <= 4.4.9 - Authenticated (Admin+) SQL Injection	CVE-2021-24864	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	October 13, 2021
Header Footer Code Manager <= 1.1.13 - Authenticated SQL Injections	CVE-2021-24791	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	October 11, 2021
Asgaros Forum <= 1.15.12 - Unauthenticated SQL Injection	CVE-2021-24827	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	October 11, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation