Have you found a vulnerability in a WordPress plugin or theme? Report vulnerabilities in WordPress plugins and themes through our bug bounty program and earn a bounty on all in-scope submissions, while we handle the responsible disclosure process on your behalf.

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Partners <= 0.2.0 - Unauthenticated PHP Object Injection

9.8

CVE-2024-56059

Dec 17, 2024

Researcher: Le Ngoc Anh

VibeBP <= 1.9.9.4.1 - Unauthenticated Privilege Escalation

9.8

CVE-2024-56040

Dec 17, 2024

Researcher: Rafie Muhammad

WPLMS <= 1.9.9 - Unauthenticated Arbitrary File Upload

9.8

CVE-2024-56046

Dec 17, 2024

Researcher: Rafie Muhammad

Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user

9.8

CVE-2024-12287

Dec 17, 2024

Researcher: Tonn

VRPConnector <= 2.0.1 - Unauthenticated PHP Object Injection

9.8

CVE-2024-56058

Dec 17, 2024

Researcher: Le Ngoc Anh

Navayan CSV Export <= 1.0.9 - Unauthenticated SQL Injection

9.8

CVE-2024-55988

Dec 14, 2024

Researcher: João Pedro Soares de Alcântara

LaunchPage.app Importer <= 1.1 - Unauthenticated SQL Injection

9.8

CVE-2024-55977

Dec 14, 2024

Researcher: João Pedro Soares de Alcântara

Code Generator Pro <= 1.2 - Unauthenticated SQL Injection

9.8

CVE-2024-55978

Dec 14, 2024

Researcher: LVT-tholv2k

Critical Site Intel <= 1.0 - Unauthenticated SQL Injection

9.8

CVE-2024-55976

Dec 14, 2024

Researcher: João Pedro Soares de Alcântara

Nabz Image Gallery <= v1.00 - Unauthenticated SQL Injection

9.8

CVE-2024-55981

Dec 14, 2024

Researcher: LVT-tholv2k

eTemplates <= 0.2.1 - Unauthenticated SQL Injection

9.8

CVE-2024-55972

Dec 14, 2024

Researcher: João Pedro Soares de Alcântara

Share Buttons – Social Media <= 1.0.2 - Unauthenticated SQL Injection

9.8

CVE-2024-55982

Dec 14, 2024

Researcher: LVT-tholv2k

Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

9.8

CVE-2024-9290

Dec 12, 2024

Researcher: Tonn

9.8

CVE-2024-11015

Dec 11, 2024

Researcher: shaman0x01

Mail Picker <= 1.0.14 - Unauthenticated PHP Object Injection

9.8

CVE-2024-54273

Dec 11, 2024

Researcher: Bonds

Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation

9.8

CVE-2024-54369

Dec 11, 2024

Researcher: stealthcopter

vBSSO-lite <= 1.4.3 - Missing Authorization to Privilege Escalation

9.8

CVE-2024-54297

Dec 11, 2024

Researcher: stealthcopter

Woolook <= 1.7.0 - Unauthenticated Local File Inclusion

9.8

CVE-2024-54375

Dec 11, 2024

Researcher: tahu.datar

ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation

9.8

CVE-2024-54295

Dec 11, 2024

Researcher: stealthcopter

CoSchool LMS <= 1.2 - Missing Authorization to Privilege Escalation

9.8

CVE-2024-54296

Dec 11, 2024

Researcher: stealthcopter

Title	CVE ID	CVSS	Researchers	Date
Partners <= 0.2.0 - Unauthenticated PHP Object Injection	CVE-2024-56059	9.8	Le Ngoc Anh	December 17, 2024
VibeBP <= 1.9.9.4.1 - Unauthenticated Privilege Escalation	CVE-2024-56040	9.8	Rafie Muhammad	December 17, 2024
WPLMS <= 1.9.9 - Unauthenticated Arbitrary File Upload	CVE-2024-56046	9.8	Rafie Muhammad	December 17, 2024
Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user	CVE-2024-12287	9.8	Tonn	December 17, 2024
VRPConnector <= 2.0.1 - Unauthenticated PHP Object Injection	CVE-2024-56058	9.8	Le Ngoc Anh	December 17, 2024
Navayan CSV Export <= 1.0.9 - Unauthenticated SQL Injection	CVE-2024-55988	9.8	João Pedro Soares de Alcântara	December 14, 2024
LaunchPage.app Importer <= 1.1 - Unauthenticated SQL Injection	CVE-2024-55977	9.8	João Pedro Soares de Alcântara	December 14, 2024
Code Generator Pro <= 1.2 - Unauthenticated SQL Injection	CVE-2024-55978	9.8	LVT-tholv2k	December 14, 2024
Critical Site Intel <= 1.0 - Unauthenticated SQL Injection	CVE-2024-55976	9.8	João Pedro Soares de Alcântara	December 14, 2024
Nabz Image Gallery <= v1.00 - Unauthenticated SQL Injection	CVE-2024-55981	9.8	LVT-tholv2k	December 14, 2024
eTemplates <= 0.2.1 - Unauthenticated SQL Injection	CVE-2024-55972	9.8	João Pedro Soares de Alcântara	December 14, 2024
Share Buttons – Social Media <= 1.0.2 - Unauthenticated SQL Injection	CVE-2024-55982	9.8	LVT-tholv2k	December 14, 2024
Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload	CVE-2024-9290	9.8	Tonn	December 12, 2024
Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user	CVE-2024-11015	9.8	shaman0x01	December 11, 2024
Mail Picker <= 1.0.14 - Unauthenticated PHP Object Injection	CVE-2024-54273	9.8	Bonds	December 11, 2024
Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation	CVE-2024-54369	9.8	stealthcopter	December 11, 2024
vBSSO-lite <= 1.4.3 - Missing Authorization to Privilege Escalation	CVE-2024-54297	9.8	stealthcopter	December 11, 2024
Woolook <= 1.7.0 - Unauthenticated Local File Inclusion	CVE-2024-54375	9.8	tahu.datar	December 11, 2024
ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation	CVE-2024-54295	9.8	stealthcopter	December 11, 2024
CoSchool LMS <= 1.2 - Missing Authorization to Privilege Escalation	CVE-2024-54296	9.8	stealthcopter	December 11, 2024

Submit Vulnerability

«
‹
1
2
...
10
11
12
...
1092
1093
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Dec 9, 2024 Vulns
1	SOPROBRO	103
2	vgo0	69
3	Mika	49
4	Peter Thaleikis	47
5	João Pedro Soares de Alcântara	45
6	Rafie Muhammad	35
7	Lucio Sá	25
8	Francesco Carlucci	25
9	zaim	25
10	stealthcopter	22
11	theviper17y	20
12	thiennv	17
13	ardias	17
14	yudha	17
15	zakaria	16
16	Tieu Pham Trong Nhan	14
17	Colin Xu	13
18	Trương Hữu Phúc (truonghuuphuc)	13
19	LVT-tholv2k	13
20	Bonds	11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation