🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

AllWebMenus WordPress Menu Plugin <= 1.1.3 - Remote File Inclusion

9.8

CVE-2011-3981

Sep 19, 2011

Researcher: Ben Schmidt

Global Flash Gallery <= 0.15.1 - Arbitrary File Upload

9.8

CVE ID Unknown

Sep 8, 2011

Researcher: Ashiyane Digital Security Team

Eventify - Simple Events <= 1.7.f - SQL Injection via eventid

8.1

CVE ID Unknown

Sep 7, 2011

Researcher: Miroslav Stampar

SCORM Cloud For WordPress < 1.0.7 - SQL Injection

9.8

CVE-2011-5216

Sep 7, 2011

Researcher: Miroslav Stampar

Search Autocomplete < 1.0.9 - SQL Injection

9.8

CVE ID Unknown

Sep 1, 2011

Researcher: Miroslav Stampar

TimThumb <= 1.33 - Remote File Download

9.8

CVE-2011-4106

Aug 1, 2011

Researcher: Mark Maunder

FV Flowplayer Video Player <= 1.2.11 - Cross-Site Scripting

6.1

CVE-2011-4568

Jul 22, 2011

Researchers:

eShop < 6.2.9 - Reflected Cross-Site Scripting

6.5

CVE ID Unknown

Jul 20, 2011

Researcher: HTBridge

Social Slider < 7.4.2 - SQL Injection

8.8

CVE-2011-5286

Jul 20, 2011

Researcher: High-Tech Bridge Security Research Lab

WordPress Share Buttons Plugin – AddThis < 2.2.0 - Code Injection

9.8

CVE ID Unknown

Jun 21, 2011

Researchers:

WordPress Core < 3.1.3 - Security Hardening

6.3

CVE-2011-3125

May 25, 2011

Researcher: Alexander Concha

WordPress Core < 3.1.3 - Sensitive Information Disclosure

4.3

CVE-2011-3128

May 25, 2011

Researchers:

WordPress Core < 3.1.3 - Clickjacking

7.1

CVE-2011-3127

May 25, 2011

Researchers:

WordPress Core < 3.1.3 - Media Related Security Issue

6.3

CVE-2011-3122

May 25, 2011

Researchers: Richard Lundeen of Microsoft, Jesse Ou of Microsoft

WordPress Core <= 3.1.2 - Arbitrary File Upload

8.8

CVE-2011-3129

May 25, 2011

Researchers:

WordPress Core <= 3.1.2 - SQL Injection

8.8

CVE-2011-3130

May 25, 2011

Researcher: John Lamansky

WordPress Core < 3.1.3 - Username Enumeration

5.3

CVE-2011-3126

May 25, 2011

Researcher: Verónica Valeros

Sermon Browser < 0.43.6 - Cross-Site Scripting

6.1

CVE ID Unknown

Apr 26, 2011

Researcher: Ma3sTr0-Dz

WordPress Core < 3.0.6 - Incorrect Authorization Checks

6.3

CVE-2011-5270

Apr 26, 2011

Researchers:

Sermon Browser < 0.43.6 - SQL Injection

9.8

CVE ID Unknown

Apr 26, 2011

Researcher: Ma3sTr0-Dz

Title	CVE ID	CVSS	Researchers	Date
AllWebMenus WordPress Menu Plugin <= 1.1.3 - Remote File Inclusion	CVE-2011-3981	9.8	Ben Schmidt	September 19, 2011
Global Flash Gallery <= 0.15.1 - Arbitrary File Upload		9.8	Ashiyane Digital Security Team	September 8, 2011
Eventify - Simple Events <= 1.7.f - SQL Injection via eventid		8.1	Miroslav Stampar	September 7, 2011
SCORM Cloud For WordPress < 1.0.7 - SQL Injection	CVE-2011-5216	9.8	Miroslav Stampar	September 7, 2011
Search Autocomplete < 1.0.9 - SQL Injection		9.8	Miroslav Stampar	September 1, 2011
TimThumb <= 1.33 - Remote File Download	CVE-2011-4106	9.8	Mark Maunder	August 1, 2011
FV Flowplayer Video Player <= 1.2.11 - Cross-Site Scripting	CVE-2011-4568	6.1		July 22, 2011
eShop < 6.2.9 - Reflected Cross-Site Scripting		6.5	HTBridge	July 20, 2011
Social Slider < 7.4.2 - SQL Injection	CVE-2011-5286	8.8	High-Tech Bridge Security Research Lab	July 20, 2011
WordPress Share Buttons Plugin – AddThis < 2.2.0 - Code Injection		9.8		June 21, 2011
WordPress Core < 3.1.3 - Security Hardening	CVE-2011-3125	6.3	Alexander Concha	May 25, 2011
WordPress Core < 3.1.3 - Sensitive Information Disclosure	CVE-2011-3128	4.3		May 25, 2011
WordPress Core < 3.1.3 - Clickjacking	CVE-2011-3127	7.1		May 25, 2011
WordPress Core < 3.1.3 - Media Related Security Issue	CVE-2011-3122	6.3	Richard Lundeen of Microsoft, Jesse Ou of Microsoft	May 25, 2011
WordPress Core <= 3.1.2 - Arbitrary File Upload	CVE-2011-3129	8.8		May 25, 2011
WordPress Core <= 3.1.2 - SQL Injection	CVE-2011-3130	8.8	John Lamansky	May 25, 2011
WordPress Core < 3.1.3 - Username Enumeration	CVE-2011-3126	5.3	Verónica Valeros	May 25, 2011
Sermon Browser < 0.43.6 - Cross-Site Scripting		6.1	Ma3sTr0-Dz	April 26, 2011
WordPress Core < 3.0.6 - Incorrect Authorization Checks	CVE-2011-5270	6.3		April 26, 2011
Sermon Browser < 0.43.6 - SQL Injection		9.8	Ma3sTr0-Dz	April 26, 2011

Submit Vulnerability

«
‹
1
2
...
1000
1001
1002
...
1012
1013
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Oct 15, 2024 Vulns
1	SOPROBRO	215
2	João Pedro Soares de Alcântara	73
3	Francesco Carlucci	57
4	stealthcopter	47
5	Gab	46
6	István Márton	38
7	Peter Thaleikis	34
8	Mika	34
9	vgo0	28
10	LVT-tholv2k	25
11	theviper17y	15
12	wesley (wcraft)	15
13	Trương Hữu Phúc (truonghuuphuc)	12
14	zer0gh0st	12
15	Tonn	11
16	Le Ngoc Anh	9
17	Webbernaut	8
18	Ankit Patel	8
19	Rafie Muhammad	8
20	ghsinfosec	7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation