🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our SQL Injection firewall rule

1,488,679

Attacks Blocked in Past 24 Hours

Showing 921-940 of 1,444 Vulnerabilities

Ajax Search Pro <= 4.18.7 - Authenticated (Subscriber+) SQL Injection

8.8

CVE ID Unknown

Aug 3, 2020

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection

4.9

CVE-2020-5768

Jul 16, 2020

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SRS Simple Hits Counter Plugin for WordPress 1.03 - 1.04 - Unauthenticated SQL Injection

7.5

CVE-2020-5766

Jul 10, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Payment Form for PayPal Pro < 1.1.65 - SQL Injection

9.8

CVE-2020-14092

Jul 2, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nexos - Real Estate WordPress Theme <= 1.7 - SQL Injection

9.8

CVE ID Unknown

Jun 28, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Travel Booking WordPress Theme < 2.8.4 - SQL Injection

9.8

CVE ID Unknown

Jun 23, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter

9.8

CVE-2020-13640

Jun 12, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Events Manager <= 5.9.7.3 - Admin+ SQL Injection

7.2

CVE-2020-35012

Jun 7, 2020

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AdRotate < 5.8.4 - Authenticated SQL Injection

7.2

CVE-2021-24138

Jun 3, 2020

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection

8.8

CVE-2021-24137

May 29, 2020

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Form Maker by 10Web <= 1.13.35 - SQL Injection

7.2

CVE ID Unknown

May 26, 2020

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection

9.8

CVE ID Unknown

May 22, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection

4.7

CVE-2020-5579

May 19, 2020

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Ajax Load More plugin < 5.3.2 - SQL Injection

7.2

CVE-2021-24140

May 18, 2020

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter

9.8

CVE-2021-24139

May 15, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Chop Slider 3 <= 3.4 - Unauthenticated SQL Injection

9.8

CVE-2020-11530

May 9, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification

8.8

CVE ID Unknown

May 5, 2020

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WordPress WP-Advanced-Search <= 3.3.6 - SQL Injection

8.8

CVE-2020-12104

Apr 28, 2020

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Duplicate Page Plugins <= (Various Versions) - SQL Injection

8.8

CVE ID Unknown

Apr 25, 2020

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

LearnDash <= 3.1.5 - Unauthenticated SQL Injection

9.8

CVE-2020-6009

Apr 1, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
Ajax Search Pro <= 4.18.7 - Authenticated (Subscriber+) SQL Injection		8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	August 3, 2020
Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection	CVE-2020-5768	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	July 16, 2020
SRS Simple Hits Counter Plugin for WordPress 1.03 - 1.04 - Unauthenticated SQL Injection	CVE-2020-5766	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	July 10, 2020
Payment Form for PayPal Pro < 1.1.65 - SQL Injection	CVE-2020-14092	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 2, 2020
Nexos - Real Estate WordPress Theme <= 1.7 - SQL Injection		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 28, 2020
Travel Booking WordPress Theme < 2.8.4 - SQL Injection		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 23, 2020
Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter	CVE-2020-13640	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 12, 2020
Events Manager <= 5.9.7.3 - Admin+ SQL Injection	CVE-2020-35012	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	June 7, 2020
AdRotate < 5.8.4 - Authenticated SQL Injection	CVE-2021-24138	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	June 3, 2020
Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection	CVE-2021-24137	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 29, 2020
Form Maker by 10Web <= 1.13.35 - SQL Injection		7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	May 26, 2020
MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 22, 2020
Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection	CVE-2020-5579	4.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	May 19, 2020
Ajax Load More plugin < 5.3.2 - SQL Injection	CVE-2021-24140	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	May 18, 2020
Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter	CVE-2021-24139	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 15, 2020
Chop Slider 3 <= 3.4 - Unauthenticated SQL Injection	CVE-2020-11530	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 9, 2020
WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification		8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 5, 2020
WordPress WP-Advanced-Search <= 3.3.6 - SQL Injection	CVE-2020-12104	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	April 28, 2020
Duplicate Page Plugins <= (Various Versions) - SQL Injection		8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	April 25, 2020
LearnDash <= 3.1.5 - Unauthenticated SQL Injection	CVE-2020-6009	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 1, 2020

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation