🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Meks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-0664

Jan 26, 2024

Researcher: arpeetrathi

WP Dashboard Notes <= 1.0.10 - Missing Authorization to Arbitrary Private Notes Update

4.3

CVE-2023-7239

Jan 26, 2024

Researcher: Pedro Cuco (Illex)

Mang Board WP <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2024-22306

Jan 26, 2024

Researcher: Byeongjun Jo

Allow SVG <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

6.4

CVE-2023-6541

Jan 26, 2024

Researcher: Bob Matyas

(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-0254

Jan 26, 2024

Researcher: Francesco Carlucci

Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1

CVE-2024-0660

Jan 26, 2024

Researcher: Webbernaut

Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute

5.4

CVE-2024-0667

Jan 26, 2024

Researcher: SudoBash

Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVE-2024-0823

Jan 26, 2024

Researcher: Webbernaut

Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything

6.4

CVE-2024-0824

Jan 26, 2024

Researcher: Webbernaut

WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source

4.4

CVE-2024-0630

Jan 25, 2024

Researcher: Colin Xu

Elementor Addons by Livemesh <= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-0448

Jan 25, 2024

Researcher: Webbernaut

Estatik Real Estate Plugin <= 4.1.0 - Reflected Cross-Site Scripting

6.1

CVE-2023-6050

Jan 25, 2024

Researcher: Erwan LR

10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation

6.5

CVE-2023-6985

Jan 25, 2024

Researcher: Krzysztof Zając

WPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]

4.4

CVE-2024-0625

Jan 24, 2024

Researcher: Sh

File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVE-2023-6846

Jan 24, 2024

Researcher: Tobias Weißhaar (kun_19)

Views for WPForms <= 3.2.2 - Missing Authorization via get_form_fields

4.3

CVE-2024-0372

Jan 24, 2024

Researcher: Francesco Carlucci

Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

8.8

CVE-2023-6933

Jan 24, 2024

Researcher: Sam Pizzey (mopman)

Views for WPForms <= 3.2.2 - Missing Authorization via save_view

4.3

CVE-2024-0370

Jan 24, 2024

Researcher: Francesco Carlucci

PDF Poster - PDF Embedder Plugin for WordPress <= 2.1.17 - Reflected Cross-Site Scripting

6.1

CVE-2024-23508

Jan 24, 2024

Researcher: Le Ngoc Anh

Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view

4.3

CVE-2024-0374

Jan 24, 2024

Researcher: Francesco Carlucci

Title	CVE ID	CVSS	Researchers	Date
Meks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2024-0664	4.4	arpeetrathi	January 26, 2024
WP Dashboard Notes <= 1.0.10 - Missing Authorization to Arbitrary Private Notes Update	CVE-2023-7239	4.3	Pedro Cuco (Illex)	January 26, 2024
Mang Board WP <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2024-22306	4.4	Byeongjun Jo	January 26, 2024
Allow SVG <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG	CVE-2023-6541	6.4	Bob Matyas	January 26, 2024
(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-0254	6.4	Francesco Carlucci	January 26, 2024
Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting	CVE-2024-0660	6.1	Webbernaut	January 26, 2024
Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute	CVE-2024-0667	5.4	SudoBash	January 26, 2024
Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-0823	5.4	Webbernaut	January 26, 2024
Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything	CVE-2024-0824	6.4	Webbernaut	January 26, 2024
WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source	CVE-2024-0630	4.4	Colin Xu	January 25, 2024
Elementor Addons by Livemesh <= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-0448	6.4	Webbernaut	January 25, 2024
Estatik Real Estate Plugin <= 4.1.0 - Reflected Cross-Site Scripting	CVE-2023-6050	6.1	Erwan LR	January 25, 2024
10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation	CVE-2023-6985	6.5	Krzysztof Zając	January 25, 2024
WPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]	CVE-2024-0625	4.4	Sh	January 24, 2024
File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload	CVE-2023-6846	8.8	Tobias Weißhaar (kun_19)	January 24, 2024
Views for WPForms <= 3.2.2 - Missing Authorization via get_form_fields	CVE-2024-0372	4.3	Francesco Carlucci	January 24, 2024
Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection	CVE-2023-6933	8.8	Sam Pizzey (mopman)	January 24, 2024
Views for WPForms <= 3.2.2 - Missing Authorization via save_view	CVE-2024-0370	4.3	Francesco Carlucci	January 24, 2024
PDF Poster - PDF Embedder Plugin for WordPress <= 2.1.17 - Reflected Cross-Site Scripting	CVE-2024-23508	6.1	Le Ngoc Anh	January 24, 2024
Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view	CVE-2024-0374	4.3	Francesco Carlucci	January 24, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Sep 1, 2024 Vulns
1	Francesco Carlucci	43
2	vgo0	36
3	wesley (wcraft)	22
4	Lucio Sá	14
5	Krzysztof Zając	12
6	stealthcopter	11
7	Peter Thaleikis	11
8	Marco Wotschka	7
9	Webbernaut	7
10	Daniel Ruf	5
11	TANG Cheuk Hei (siunam)	5
12	zer0gh0st	4
13	Tonn	4
14	Robert DeVore	3
15	LVT-tholv2k	3
16	Le Ngoc Anh	3
17	István Márton	3
18	rezaduty	3
19	theviper17y	2
20	Michelle Porter	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation