WordPress Vulnerability Database

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Title CVE ID CVSS Researchers Date
Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2023-7088 6.4 Bob Matyas January 23, 2024
Marketing Twitter Bot <= 1.11 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting CVE-2023-7197 6.1 Daniel Ruf January 23, 2024
illi Link Party! <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Link Deletion CVE-2023-7231 5.3 Bob Matyas January 23, 2024
Ultimate Noindex Nofollow Tool <= 1.1.2 - Cross-Site Request Forgery to Settings Update CVE-2023-7196 6.1 Daniel Ruf January 23, 2024
Better Follow Button for Jetpack <= 8.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-7168 4.4 Bob Matyas January 23, 2024
illi Link Party! <= 1.0 - Unauthenticated Stored Cross-Site Scripting CVE-2023-7228 7.2 Bob Matyas January 23, 2024
Content Views <= 3.6.2 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings CVE-2024-0612 4.4 Akbar Kustirama January 22, 2024
Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-0703 4.4 Dipak Panchal (th3.d1p4k) January 22, 2024
PDF Generator For Fluent Forms <= 1.1.7 - Cross-Site Scripting CVE-2023-6953 4.9 drop January 22, 2024
Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting CVE-2024-0587 6.1 stealthcopter January 22, 2024
File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames CVE-2024-0761 8.1 Yuki Haruma January 22, 2024
Popup Box Business (7.0.0 - 7.9.0) and Developer (20.0.0 - 20.9.0) - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-6591 6.6 John Jefferson Li January 22, 2024
easy.jobs <= 2.4.6 - Missing Authorization to Settings Update CVE-2023-6843 6.5 Krzysztof Zając January 21, 2024
PDF Viewer & 3D PDF Flipbook – DearPDF <= 2.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-23505 6.4 Ngô Thiên An (ancorn_) January 19, 2024
WPForms Pro 1.8.4 - 1.8.5.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission CVE-2023-7063 7.2 drop January 19, 2024
Chartjs <= 2023.2 - Authenticated(Editor+) Stored Cross-Site Scripting CVE-2023-6081 4.4 Sergen Koç, Asif Nawaz Minhas January 19, 2024
Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename CVE-2024-0221 9.1 Bence Szalai January 19, 2024
Posts List Designer by Category – List Category Posts Or Recent Posts <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-23502 6.4 Ngô Thiên An (ancorn_) January 19, 2024
WP-Lister Lite for eBay <= 3.5.7 - Reflected Cross-Site Scripting via 's' CVE-2024-22307 6.1 Dimas Maulana January 19, 2024
ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection CVE-2024-22309 9.8 Le Ngoc Anh January 19, 2024

Researcher Hall of Fame (Past 30 days)

Rank Name
Vulnerabilities since Oct 19, 2024
Vulns
1 SOPROBRO 211
2 João Pedro Soares de Alcântara 61
3 Francesco Carlucci 55
4 Gab 44
5 stealthcopter 39
6 Peter Thaleikis 37
7 István Márton 35
8 Mika 29
9 LVT-tholv2k 23
10 vgo0 22
11 wesley (wcraft) 15
12 Trương Hữu Phúc (truonghuuphuc) 15
13 theviper17y 14
14 zer0gh0st 13
15 Tonn 12
16 Tieu Pham Trong Nhan 9
17 Rafie Muhammad 8
18 Arkadiusz Hydzik 8
19 incognito 8
20 Le Ngoc Anh 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation