WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation
9.8
CVE-2024-9289
Sep 30, 2024
Researcher: Tonn
WP Timeline – Vertical and Horizontal timeline plugin <= 3.6.7 - Unauthenticated Local File Inclusion
9.8
CVE-2024-47323
Sep 25, 2024
Researcher: Bonds
REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover
9.8
CVE-2024-8485
Sep 24, 2024
Researcher: wesley (wcraft)
LatePoint <= 5.0.12 - Authentication Bypass
9.8
CVE-2024-8943
Sep 24, 2024
Researcher: István Márton
The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection
9.8
CVE-2024-8275
Sep 24, 2024
Researcher: Foxyyy
VR Calendar <= 2.4.4 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44013
Sep 24, 2024
Researcher: tahu.datar
MH Board <= 1.3.2.1 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44017
Sep 24, 2024
Researcher: tahu.datar
Podiant <= 1.1 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44016
Sep 24, 2024
Researcher: tahu.datar
WP Ticket Ultra Help Desk & Support Plugin <= 1.0.5 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44011
Sep 24, 2024
Researcher: tahu.datar
WP Newsletter Subscription <= 1.1 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44012
Sep 24, 2024
Researcher: tahu.datar
Vmax Project Manager <= 1.0 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44014
Sep 24, 2024
Researcher: tahu.datar
Instant Chat Floating Button for WordPress Websites <= 1.0.5 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44018
Sep 24, 2024
Researcher: tahu.datar
ABCApp Creator <= 1.1.2 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44023
Sep 24, 2024
Researcher: tahu.datar
WPSPX <= 1.0.2 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44034
Sep 24, 2024
Researcher: tahu.datar
Users Control <= 1.0.16 - Unauthenticated Local File Inclusion
9.8
CVE-2024-44015
Sep 24, 2024
Researcher: tahu.datar
Contact Form 7 Campaign Monitor Extension <= 0.4.67 - Missing Authorization to Unauthenticated Arbitrary File Deletion
9.8
CVE-2024-44019
Sep 24, 2024
Researcher: Abdi Pranata
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation
9.8
CVE-2024-8791
Sep 23, 2024
Researcher: wesley (wcraft)
LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection
9.8
CVE-2024-8911
Sep 20, 2024
Researcher: István Márton
Webo-facto <= 1.40 - Unauthenticated Privilege Escalation
9.8
CVE-2024-8853
Sep 17, 2024
Researcher: István Márton
WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation
9.8
CVE-2024-8277
Sep 10, 2024
Researcher: Tonn
Title CVE ID CVSS Researchers Date
WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation CVE-2024-9289 9.8 Tonn September 30, 2024
WP Timeline – Vertical and Horizontal timeline plugin <= 3.6.7 - Unauthenticated Local File Inclusion CVE-2024-47323 9.8 Bonds September 25, 2024
REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover CVE-2024-8485 9.8 wesley (wcraft) September 24, 2024
LatePoint <= 5.0.12 - Authentication Bypass CVE-2024-8943 9.8 István Márton September 24, 2024
The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection CVE-2024-8275 9.8 Foxyyy September 24, 2024
VR Calendar <= 2.4.4 - Unauthenticated Local File Inclusion CVE-2024-44013 9.8 tahu.datar September 24, 2024
MH Board <= 1.3.2.1 - Unauthenticated Local File Inclusion CVE-2024-44017 9.8 tahu.datar September 24, 2024
Podiant <= 1.1 - Unauthenticated Local File Inclusion CVE-2024-44016 9.8 tahu.datar September 24, 2024
WP Ticket Ultra Help Desk & Support Plugin <= 1.0.5 - Unauthenticated Local File Inclusion CVE-2024-44011 9.8 tahu.datar September 24, 2024
WP Newsletter Subscription <= 1.1 - Unauthenticated Local File Inclusion CVE-2024-44012 9.8 tahu.datar September 24, 2024
Vmax Project Manager <= 1.0 - Unauthenticated Local File Inclusion CVE-2024-44014 9.8 tahu.datar September 24, 2024
Instant Chat Floating Button for WordPress Websites <= 1.0.5 - Unauthenticated Local File Inclusion CVE-2024-44018 9.8 tahu.datar September 24, 2024
ABCApp Creator <= 1.1.2 - Unauthenticated Local File Inclusion CVE-2024-44023 9.8 tahu.datar September 24, 2024
WPSPX <= 1.0.2 - Unauthenticated Local File Inclusion CVE-2024-44034 9.8 tahu.datar September 24, 2024
Users Control <= 1.0.16 - Unauthenticated Local File Inclusion CVE-2024-44015 9.8 tahu.datar September 24, 2024
Contact Form 7 Campaign Monitor Extension <= 0.4.67 - Missing Authorization to Unauthenticated Arbitrary File Deletion CVE-2024-44019 9.8 Abdi Pranata September 24, 2024
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation CVE-2024-8791 9.8 wesley (wcraft) September 23, 2024
LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection CVE-2024-8911 9.8 István Márton September 20, 2024
Webo-facto <= 1.40 - Unauthenticated Privilege Escalation CVE-2024-8853 9.8 István Márton September 17, 2024
WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation CVE-2024-8277 9.8 Tonn September 10, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Dec 6, 2024
Vulns
1 SOPROBRO 74
2 vgo0 39
3 Peter Thaleikis 38
4 Mika 28
5 Francesco Carlucci 20
6 João Pedro Soares de Alcântara 18
7 zaim 16
8 stealthcopter 16
9 thiennv 13
10 theviper17y 13
11 yudha 12
12 ardias 11
13 Arkadiusz Hydzik 10
14 Lucio Sá 9
15 mikemyers 9
16 LVT-tholv2k 9
17 zakaria 9
18 Colin Xu 8
19 Trương Hữu Phúc (truonghuuphuc) 7
20 Tieu Pham Trong Nhan 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation