🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our XSS: Cross Site Scripting firewall rule

15,645,576

Attacks Blocked in Past 24 Hours

Showing 6961-6980 of 7,094 Vulnerabilities

WordPress Integrator <= 1.32 - Cross-Site Scripting

6.1

CVE-2012-5913

Mar 28, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7.1

CVE ID Unknown

Mar 27, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CMS Tree Page View < 0.8.9 - Cross-Site Scripting

6.1

CVE-2012-1834

Mar 26, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

IFrame Admin Pages <= 0.1 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

Mar 15, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

s2Member® Framework (Membership, Member Level Roles, Access Capabilities, PayPal Members) < 111220 - Cross-Site Scripting

7.2

CVE-2011-5082

Feb 12, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Slideshow Gallery <= 1.1.4 - Cross-Site Scripting

7.1

CVE-2012-5229

Jan 26, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Shortcode Redirect <= 1.0.01 - Cross-Site Scripting

5.4

CVE-2012-5325

Jan 18, 2012

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

My Calendar < 1.10.5 - Cross-Site Scripting

6.1

CVE-2012-6527

Jan 18, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

YouSayToo auto-publishing plugin <= 1.0 - Cross-Site Scripting

6.1

CVE-2012-0901

Jan 8, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Pretty Link Lite < 1.5.6 - Cross-Site Scripting

6.1

CVE-2011-5192

Jan 6, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Pay With Tweet <= 1.1 - Cross-Site Scripting

6.1

CVE-2012-5349

Jan 6, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WordPress Core <= 3.3 - Cross-Site Scripting

6.4

CVE-2012-0287

Jan 3, 2012

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

WP Live.php <= 1.2.1 - Cross-Site Scripting

6.1

CVE-2012-5346

Jan 1, 2012

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

TheCartPress eCommerce Shopping Cart <= 1.1.5 - Cross-Site Scripting

6.1

CVE-2011-5207

Dec 31, 2011

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Connections Business Directory < 0.7.1.6 - Authorization Bypass

6.1

CVE-2011-5254

Dec 29, 2011

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WordPress Sentinel <= 1.0.0 - Cross-Site Scripting

6.1

CVE-2011-5225

Dec 14, 2011

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Pretty Link Lite < 1.5.4 - Cross-Site Scripting

6.1

CVE-2011-5191

Dec 12, 2011

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Disqus Comment System < 2.68 - Reflected Cross-Site Scripting

7.1

CVE ID Unknown

Dec 11, 2011

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Lazyest Backup < 0.2.2 - Reflected Cross-Site Scripting

6.1

CVE-2011-5264

Dec 5, 2011

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Pretty Links – Link Management, Branding, Tracking & Sharing Plugin < 1.5.6 - Reflected Cross-Site Scripting

6.1

CVE-2011-4595

Dec 4, 2011

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
WordPress Integrator <= 1.32 - Cross-Site Scripting	CVE-2012-5913	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 28, 2012
Register Plus Redux <= 4.3 - Cross-Site Scripting		7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	March 27, 2012
CMS Tree Page View < 0.8.9 - Cross-Site Scripting	CVE-2012-1834	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 26, 2012
IFrame Admin Pages <= 0.1 - Reflected Cross-Site Scripting		6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 15, 2012
s2Member® Framework (Membership, Member Level Roles, Access Capabilities, PayPal Members) < 111220 - Cross-Site Scripting	CVE-2011-5082	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	February 12, 2012
Slideshow Gallery <= 1.1.4 - Cross-Site Scripting	CVE-2012-5229	7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	January 26, 2012
Shortcode Redirect <= 1.0.01 - Cross-Site Scripting	CVE-2012-5325	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	January 18, 2012
My Calendar < 1.10.5 - Cross-Site Scripting	CVE-2012-6527	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 18, 2012
YouSayToo auto-publishing plugin <= 1.0 - Cross-Site Scripting	CVE-2012-0901	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 8, 2012
Pretty Link Lite < 1.5.6 - Cross-Site Scripting	CVE-2011-5192	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 6, 2012
Pay With Tweet <= 1.1 - Cross-Site Scripting	CVE-2012-5349	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 6, 2012
WordPress Core <= 3.3 - Cross-Site Scripting	CVE-2012-0287	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 3, 2012
WP Live.php <= 1.2.1 - Cross-Site Scripting	CVE-2012-5346	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 1, 2012
TheCartPress eCommerce Shopping Cart <= 1.1.5 - Cross-Site Scripting	CVE-2011-5207	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 31, 2011
Connections Business Directory < 0.7.1.6 - Authorization Bypass	CVE-2011-5254	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 29, 2011
WordPress Sentinel <= 1.0.0 - Cross-Site Scripting	CVE-2011-5225	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 14, 2011
Pretty Link Lite < 1.5.4 - Cross-Site Scripting	CVE-2011-5191	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 12, 2011
Disqus Comment System < 2.68 - Reflected Cross-Site Scripting		7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	December 11, 2011
Lazyest Backup < 0.2.2 - Reflected Cross-Site Scripting	CVE-2011-5264	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 5, 2011
Pretty Links – Link Management, Branding, Tracking & Sharing Plugin < 1.5.6 - Reflected Cross-Site Scripting	CVE-2011-4595	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 4, 2011

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation