WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
ARI Stream Quiz <= 1.3.2 - Authenticated(Contributor+) Content Injection
4.3
CVE-2023-47513
Nov 7, 2023
Researcher: Abdi Pranata
NitroPack <= 1.9.2 - Missing Authorization via multiple AJAX functions
6.3
CVE ID Unknown
Nov 7, 2023
Researchers:
Image Hover Effects <= 5.5 - Cross-Site Request Forgery
4.3
CVE-2023-47552
Nov 7, 2023
Researcher: Abdi Pranata
Products, Order & Customers Export for WooCommerce <= 2.0.10 - Reflected Cross-Site Scripting via date parameters
6.1
CVE-2023-47547
Nov 7, 2023
Researcher: thiennv
Custom post types <= 4.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE ID Unknown
Nov 7, 2023
Researchers:
Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions
4.3
CVE-2023-47557
Nov 7, 2023
Researcher: Rafshanzani Suhada
ProfileGrid <= 5.7.1 - Cross-Site Request Forgery
4.3
CVE-2023-47644
Nov 7, 2023
Researcher: thiennv
Ecwid Ecommerce Shopping Cart <= 6.12.3 - Missing Authorization on multiple functions
5.4
CVE ID Unknown
Nov 7, 2023
Researchers:
Pinyin Slugs <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-47511
Nov 7, 2023
Researcher: yuyudhn
Master Slider Pro <= 3.6.5 - Unauthenticated PHP Object Injection
9.8
CVE-2023-47507
Nov 7, 2023
Researcher: Rafie Muhammad
Product Enquiry for WooCommerce <= 3.1 - Unauthenticated Stored Cross-Site Scripting via name
6.1
CVE-2023-47512
Nov 7, 2023
Researcher: LEE SE HYOUNG
Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings
4.3
CVE-2023-47661
Nov 7, 2023
Researcher: Abdi Pranata
WP Links Page <= 4.9.4 - Cross-Site Request Forgery via wplf_ajax_update_screenshots
4.3
CVE-2023-47651
Nov 7, 2023
Researcher: thiennv
CodeBard's Patron Button and Widgets for Patreon <= 2.1.9 - Reflected Cross-Site Scripting via cb_p6_tab
6.1
CVE-2023-47524
Nov 7, 2023
Researcher: Le Ngoc Anh
Foyer <= 1.7.5 - Content Injection via Improper Access Control
4.3
CVE-2023-47663
Nov 7, 2023
Researcher: Abdi Pranata
CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization
5.3
CVE-2023-47241
Nov 7, 2023
Researcher: Mika
Auto Affiliate Links <= 6.4.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2023-47652
Nov 7, 2023
Researcher: LEE SE HYOUNG
Donations Made Easy – Smart Donations <= 4.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-47550
Nov 7, 2023
Researcher: thiennv
OneClick Chat to Order <= 1.0.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-47546
Nov 7, 2023
Researcher: Luqman Hakim Y
Photo Feed <= 2.2.1 - Reflected Cross-Site Scripting via pf-gid
6.1
CVE-2023-47522
Nov 7, 2023
Researcher: Le Ngoc Anh
Title CVE ID CVSS Researchers Date
ARI Stream Quiz <= 1.3.2 - Authenticated(Contributor+) Content Injection CVE-2023-47513 4.3 Abdi Pranata November 7, 2023
NitroPack <= 1.9.2 - Missing Authorization via multiple AJAX functions 6.3 November 7, 2023
Image Hover Effects <= 5.5 - Cross-Site Request Forgery CVE-2023-47552 4.3 Abdi Pranata November 7, 2023
Products, Order & Customers Export for WooCommerce <= 2.0.10 - Reflected Cross-Site Scripting via date parameters CVE-2023-47547 6.1 thiennv November 7, 2023
Custom post types <= 4.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting 4.4 November 7, 2023
Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions CVE-2023-47557 4.3 Rafshanzani Suhada November 7, 2023
ProfileGrid <= 5.7.1 - Cross-Site Request Forgery CVE-2023-47644 4.3 thiennv November 7, 2023
Ecwid Ecommerce Shopping Cart <= 6.12.3 - Missing Authorization on multiple functions 5.4 November 7, 2023
Pinyin Slugs <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-47511 4.4 yuyudhn November 7, 2023
Master Slider Pro <= 3.6.5 - Unauthenticated PHP Object Injection CVE-2023-47507 9.8 Rafie Muhammad November 7, 2023
Product Enquiry for WooCommerce <= 3.1 - Unauthenticated Stored Cross-Site Scripting via name CVE-2023-47512 6.1 LEE SE HYOUNG November 7, 2023
Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings CVE-2023-47661 4.3 Abdi Pranata November 7, 2023
WP Links Page <= 4.9.4 - Cross-Site Request Forgery via wplf_ajax_update_screenshots CVE-2023-47651 4.3 thiennv November 7, 2023
CodeBard's Patron Button and Widgets for Patreon <= 2.1.9 - Reflected Cross-Site Scripting via cb_p6_tab CVE-2023-47524 6.1 Le Ngoc Anh November 7, 2023
Foyer <= 1.7.5 - Content Injection via Improper Access Control CVE-2023-47663 4.3 Abdi Pranata November 7, 2023
CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization CVE-2023-47241 5.3 Mika November 7, 2023
Auto Affiliate Links <= 6.4.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2023-47652 6.1 LEE SE HYOUNG November 7, 2023
Donations Made Easy – Smart Donations <= 4.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-47550 6.4 thiennv November 7, 2023
OneClick Chat to Order <= 1.0.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-47546 4.4 Luqman Hakim Y November 7, 2023
Photo Feed <= 2.2.1 - Reflected Cross-Site Scripting via pf-gid CVE-2023-47522 6.1 Le Ngoc Anh November 7, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 26, 2024
Vulns
1 stealthcopter 26
2 Francesco Carlucci 26
3 wesley (wcraft) 23
4 vgo0 22
5 Lucio Sá 19
6 Daniel Ruf 11
7 Krzysztof Zając 10
8 Peter Thaleikis 7
9 Webbernaut 7
10 Marco Wotschka 7
11 Le Ngoc Anh 5
12 Muhammad Daffa 5
13 Fariq Fadillah Gusti Insani (fariqfgi) 4
14 rezaduty 4
15 István Márton 4
16 Rafie Muhammad 3
17 Sharanabasappa 3
18 Robert DeVore 3
19 LVT-tholv2k 3
20 Rasoul Jahanshahi 3

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation