WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Elementor Timeline Widget <= 2.2 - Missing Authorization to Notice Dismissal
4.3
CVE-2023-49755
Dec 4, 2023
Researcher: Abdi Pranata
Dashboard Widgets Suite <= 3.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-49743
Dec 4, 2023
Researcher: Rachit Arora
WooDiscuz – WooCommerce Comments <= 2.3.0 - Cross-Site Request Forgery
4.3
CVE-2023-49759
Dec 4, 2023
Researcher: Skalucy
Eventin <= 3.3.52 - Missing Authorization
4.3
CVE-2023-49756
Dec 4, 2023
Researcher: Abdi Pranata
Product Enquiry for WooCommerce <= 3.0 - Cross-Site Request Forgery
4.3
CVE-2023-49761
Dec 4, 2023
Researcher: thiennv
CSprite <= 1.1 - Cross-Site Request Forgery
4.3
CVE-2023-49763
Dec 4, 2023
Researcher: Skalucy
Adifier System < 3.1.4 - Unauthenticated Local File Inclusion
9.8
CVE-2023-49753
Dec 4, 2023
Researcher: RE-ALTER
Awesome Support <= 6.1.10 - Missing Authorization
5.4
CVE-2023-49757
Dec 4, 2023
Researcher: Abdi Pranata
Nested Pages <= 3.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-49195
Dec 1, 2023
Researcher: emad
Spiffy Calendar <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-49745
Dec 1, 2023
Researcher: resecured.io
Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via rt
6.1
CVE-2023-49740
Dec 1, 2023
Researcher: Le Ngoc Anh
PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin
5.3
CVE ID Unknown
Dec 1, 2023
Researchers:
PowerPack Pro for Elementor <= 2.9.23 - Reflected Cross-Site Scripting
6.1
CVE-2023-49739
Dec 1, 2023
Researcher: Rafie Muhammad
Abandoned Cart Lite for WooCommerce <= 5.16.1 - Cross-Site Request Forgery
5.3
CVE ID Unknown
Dec 1, 2023
Researchers:
Social Pug <= 1.30.0 - Missing Authorization via multiple admin_init actions
5.3
CVE-2023-49193
Dec 1, 2023
Researcher: Abdi Pranata
Enhanced Text Widget <= 1.6.3 - Missing Authorization via etw_hide_admin_notification_callback
5.3
CVE-2023-49192
Dec 1, 2023
Researcher: Abdi Pranata
Guest Author <= 2.3 - Authenticated Stored Cross-Site Scripting
6.4
CVE ID Unknown
Dec 1, 2023
Researchers:
SpeedyCache <= 1.1.2 - Missing Authorization via speedycache_create_test_cache
4.3
CVE ID Unknown
Dec 1, 2023
Researchers:
Coming soon and Maintenance mode <= 3.7.3 - IP Address Spoofing via get_real_ip
5.3
CVE-2023-49741
Dec 1, 2023
Researcher: Mika
Gift Up 2.21.3 - Cross-Site Request Forgery via consume_post
5.3
CVE ID Unknown
Dec 1, 2023
Researchers:
Title CVE ID CVSS Researchers Date
Elementor Timeline Widget <= 2.2 - Missing Authorization to Notice Dismissal CVE-2023-49755 4.3 Abdi Pranata December 4, 2023
Dashboard Widgets Suite <= 3.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-49743 4.4 Rachit Arora December 4, 2023
WooDiscuz – WooCommerce Comments <= 2.3.0 - Cross-Site Request Forgery CVE-2023-49759 4.3 Skalucy December 4, 2023
Eventin <= 3.3.52 - Missing Authorization CVE-2023-49756 4.3 Abdi Pranata December 4, 2023
Product Enquiry for WooCommerce <= 3.0 - Cross-Site Request Forgery CVE-2023-49761 4.3 thiennv December 4, 2023
CSprite <= 1.1 - Cross-Site Request Forgery CVE-2023-49763 4.3 Skalucy December 4, 2023
Adifier System < 3.1.4 - Unauthenticated Local File Inclusion CVE-2023-49753 9.8 RE-ALTER December 4, 2023
Awesome Support <= 6.1.10 - Missing Authorization CVE-2023-49757 5.4 Abdi Pranata December 4, 2023
Nested Pages <= 3.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-49195 4.4 emad December 1, 2023
Spiffy Calendar <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-49745 6.4 resecured.io December 1, 2023
Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via rt CVE-2023-49740 6.1 Le Ngoc Anh December 1, 2023
PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin 5.3 December 1, 2023
PowerPack Pro for Elementor <= 2.9.23 - Reflected Cross-Site Scripting CVE-2023-49739 6.1 Rafie Muhammad December 1, 2023
Abandoned Cart Lite for WooCommerce <= 5.16.1 - Cross-Site Request Forgery 5.3 December 1, 2023
Social Pug <= 1.30.0 - Missing Authorization via multiple admin_init actions CVE-2023-49193 5.3 Abdi Pranata December 1, 2023
Enhanced Text Widget <= 1.6.3 - Missing Authorization via etw_hide_admin_notification_callback CVE-2023-49192 5.3 Abdi Pranata December 1, 2023
Guest Author <= 2.3 - Authenticated Stored Cross-Site Scripting 6.4 December 1, 2023
SpeedyCache <= 1.1.2 - Missing Authorization via speedycache_create_test_cache 4.3 December 1, 2023
Coming soon and Maintenance mode <= 3.7.3 - IP Address Spoofing via get_real_ip CVE-2023-49741 5.3 Mika December 1, 2023
Gift Up 2.21.3 - Cross-Site Request Forgery via consume_post 5.3 December 1, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 29, 2024
Vulns
1 Francesco Carlucci 33
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Marco Wotschka 7
8 Peter Thaleikis 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 rezaduty 5
13 zer0gh0st 4
14 LVT-tholv2k 3
15 Robert DeVore 3
16 Le Ngoc Anh 3
17 RyotaK 2
18 Jorge Diaz (ddiax) 2
19 Tonn 2
20 Ankit Patel 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation