WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
GuruWalk Affiliates <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
4.4
CVE-2023-27622
Aug 28, 2023
Researcher: Pavitra Tiwari
iThemes Sync <= 2.1.13 - Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice'
4.3
CVE-2023-40001
Aug 25, 2023
Researcher: Abdi Pranata
GTranslate <= 3.0.3 - Authenticated (Administrator+) Cross-Site Scripting via Multiple Parameters
4.4
CVE-2023-4502
Aug 25, 2023
Researcher: Pablo Sanchez
Folders <= 2.9.2 - Authenticated (Author+) Arbitrary File Upload
8.8
CVE ID Unknown
Aug 25, 2023
Researchers:
Category Slider for WooCommerce <= 1.4.15 - Missing Authorization via notice dismissal functionality
4.3
CVE-2023-41132
Aug 24, 2023
Researcher: Abdi Pranata
Secure Admin IP <= 2.0 - Missing Authorization via 'saveSettings'
5.3
CVE-2023-41133
Aug 24, 2023
Researcher: Mika
FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update
5.4
CVE-2023-4520
Aug 24, 2023
Researcher: István Márton
Premmerce User Roles <= 1.0.12 - Missing Authorization via role management functions
8.3
CVE-2023-41130
Aug 24, 2023
Researcher: Nguyen Xuan Chien
Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-2995
Aug 23, 2023
Researcher: An Dang
Elements kit Elementor addons <= 2.9.1 - Missing Authorization
5.4
CVE-2023-39993
Aug 23, 2023
Researcher: Rafie Muhammad
WP VK-付费内容插件 <= 1.3.3 - Cross-Site Request Forgery via AJAX actions
4.3
CVE ID Unknown
Aug 23, 2023
Researchers:
FTP Access <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
6.1
CVE-2023-3510
Aug 22, 2023
Researcher: Bob Matyas
Vertical Marquee Plugin <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-40677
Aug 22, 2023
Researcher: yuyudhn
ReviewX <= 1.6.17 - Missing Authorization in rx_coupon_from_submit
4.3
CVE-2023-40670
Aug 22, 2023
Researcher: Abdi Pranata
Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-40669
Aug 22, 2023
Researcher: Rafshanzani Suhada
Push Notification for Post and BuddyPress <= 1.63 - Missing Authorization to Unauthenticated Admin Notice Dismissal
5.3
CVE ID Unknown
Aug 22, 2023
Researchers:
Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-40676
Aug 22, 2023
Researcher: Rio Darmawan
Royal Elementor Addons <= 1.3.75 - Cross-Site Request Forgery
4.3
CVE-2022-47175
Aug 22, 2023
Researcher: Muhammad Daffa
Landing Page Builder <= 1.5.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-40675
Aug 22, 2023
Researcher: Rio Darmawan
Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview
4.3
CVE-2023-33994
Aug 22, 2023
Researcher: Rafshanzani Suhada
Title CVE ID CVSS Researchers Date
GuruWalk Affiliates <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings CVE-2023-27622 4.4 Pavitra Tiwari August 28, 2023
iThemes Sync <= 2.1.13 - Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice' CVE-2023-40001 4.3 Abdi Pranata August 25, 2023
GTranslate <= 3.0.3 - Authenticated (Administrator+) Cross-Site Scripting via Multiple Parameters CVE-2023-4502 4.4 Pablo Sanchez August 25, 2023
Folders <= 2.9.2 - Authenticated (Author+) Arbitrary File Upload 8.8 August 25, 2023
Category Slider for WooCommerce <= 1.4.15 - Missing Authorization via notice dismissal functionality CVE-2023-41132 4.3 Abdi Pranata August 24, 2023
Secure Admin IP <= 2.0 - Missing Authorization via 'saveSettings' CVE-2023-41133 5.3 Mika August 24, 2023
FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update CVE-2023-4520 5.4 István Márton August 24, 2023
Premmerce User Roles <= 1.0.12 - Missing Authorization via role management functions CVE-2023-41130 8.3 Nguyen Xuan Chien August 24, 2023
Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-2995 4.4 An Dang August 23, 2023
Elements kit Elementor addons <= 2.9.1 - Missing Authorization CVE-2023-39993 5.4 Rafie Muhammad August 23, 2023
WP VK-付费内容插件 <= 1.3.3 - Cross-Site Request Forgery via AJAX actions 4.3 August 23, 2023
FTP Access <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2023-3510 6.1 Bob Matyas August 22, 2023
Vertical Marquee Plugin <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-40677 4.4 yuyudhn August 22, 2023
ReviewX <= 1.6.17 - Missing Authorization in rx_coupon_from_submit CVE-2023-40670 4.3 Abdi Pranata August 22, 2023
Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-40669 6.4 Rafshanzani Suhada August 22, 2023
Push Notification for Post and BuddyPress <= 1.63 - Missing Authorization to Unauthenticated Admin Notice Dismissal 5.3 August 22, 2023
Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-40676 4.4 Rio Darmawan August 22, 2023
Royal Elementor Addons <= 1.3.75 - Cross-Site Request Forgery CVE-2022-47175 4.3 Muhammad Daffa August 22, 2023
Landing Page Builder <= 1.5.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-40675 4.4 Rio Darmawan August 22, 2023
Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview CVE-2023-33994 4.3 Rafshanzani Suhada August 22, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 22, 2024
Vulns
1 stealthcopter 24
2 Francesco Carlucci 20
3 wesley (wcraft) 19
4 Lucio Sá 17
5 vgo0 15
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Marco Wotschka 8
10 Daniel Ruf 7
11 Muhammad Daffa 6
12 Krzysztof Zając 6
13 João Pedro Soares de Alcântara 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Le Ngoc Anh 5
16 Peter Thaleikis 4
17 LVT-tholv2k 4
18 Webbernaut 4
19 István Márton 4
20 rezaduty 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation