🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our SQL Injection firewall rule

1,540,288

Attacks Blocked in Past 24 Hours

Showing 1061-1080 of 1,444 Vulnerabilities

WP Jobs < 1.5 - SQL Injection

8.8

CVE-2017-9603

Jun 11, 2017

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Multi Feed Reader <= 2.2.3 - Authenticated SQL Injection

8.8

CVE-2017-2195

Jun 6, 2017

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Crelly Slider <= 1.1.1 - SQL Injection

7.2

CVE ID Unknown

Jun 5, 2017

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Event List < 0.7.9 - Authenticated (Admin+) SQL Injection

7.2

CVE-2017-9429

Jun 4, 2017

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

WP-Testimonials <= 3.4.1 - SQL Injection

8.8

CVE-2017-9418

Jun 2, 2017

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

eventr <= 1.02.2 - SQL Injection

9.8

CVE-2017-1002018

May 31, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Eventr <= 1.02.2 - SQL Injection

9.8

CVE-2017-1002019

May 30, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Easy Team Manager <= 1.3.2 - SQL Injection

9.8

CVE-2017-1002023

May 24, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Surveys 1.01.8 - Authenticated SQL Injection

9.8

CVE-2017-1002020

May 21, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Surveys <= 1.01.8 - SQL Injection

9.8

CVE-2017-1002021

May 21, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

surveys <= 1.01.8 - Authenticated SQL Injection

8.8

CVE-2017-1002022

May 21, 2017

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection

8.8

CVE ID Unknown

May 2, 2017

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WordPress Facebook <= 1.0.13 - SQL Injection

8.8

CVE ID Unknown

May 2, 2017

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

cformsII <= 14.12.3 - Authenticated SQL Injection

7.2

CVE-2017-18570

Apr 24, 2017

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SpiderCalendar <= 1.5.51 - SQL Injection

9.8

CVE-2017-7719

Apr 10, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Image Gallery with Slideshow Plugin <= 1.5.2 - SQL Injection via gid

9.8

CVE-2017-1002012

Apr 1, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Image Gallery with Slideshow Plugin <= 1.5.2 - Blind SQL Injection via imgid

9.8

CVE-2017-1002013

Apr 1, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Image Gallery with Slideshow <= 1.5.2 - SQL Injection via selectMulGallery

9.8

CVE-2017-1002015

Apr 1, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Image Gallery with Slideshow <= 1.5.2 - SQL Injection via gallery_name

9.8

CVE-2017-1002014

Apr 1, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Search Everything <= 8.1.6 - SQL Injection

9.8

CVE-2017-18571

Mar 20, 2017

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
WP Jobs < 1.5 - SQL Injection	CVE-2017-9603	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	June 11, 2017
Multi Feed Reader <= 2.2.3 - Authenticated SQL Injection	CVE-2017-2195	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	June 6, 2017
Crelly Slider <= 1.1.1 - SQL Injection		7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	June 5, 2017
Event List < 0.7.9 - Authenticated (Admin+) SQL Injection	CVE-2017-9429	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	June 4, 2017
WP-Testimonials <= 3.4.1 - SQL Injection	CVE-2017-9418	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	June 2, 2017
eventr <= 1.02.2 - SQL Injection	CVE-2017-1002018	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 31, 2017
Eventr <= 1.02.2 - SQL Injection	CVE-2017-1002019	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 30, 2017
Easy Team Manager <= 1.3.2 - SQL Injection	CVE-2017-1002023	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 24, 2017
Surveys 1.01.8 - Authenticated SQL Injection	CVE-2017-1002020	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 21, 2017
Surveys <= 1.01.8 - SQL Injection	CVE-2017-1002021	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 21, 2017
surveys <= 1.01.8 - Authenticated SQL Injection	CVE-2017-1002022	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 21, 2017
Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection		8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 2, 2017
WordPress Facebook <= 1.0.13 - SQL Injection		8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 2, 2017
cformsII <= 14.12.3 - Authenticated SQL Injection	CVE-2017-18570	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	April 24, 2017
SpiderCalendar <= 1.5.51 - SQL Injection	CVE-2017-7719	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 10, 2017
Image Gallery with Slideshow Plugin <= 1.5.2 - SQL Injection via gid	CVE-2017-1002012	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 1, 2017
Image Gallery with Slideshow Plugin <= 1.5.2 - Blind SQL Injection via imgid	CVE-2017-1002013	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 1, 2017
Image Gallery with Slideshow <= 1.5.2 - SQL Injection via selectMulGallery	CVE-2017-1002015	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 1, 2017
Image Gallery with Slideshow <= 1.5.2 - SQL Injection via gallery_name	CVE-2017-1002014	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 1, 2017
Search Everything <= 8.1.6 - SQL Injection	CVE-2017-18571	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	March 20, 2017

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation