WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Captivate Sync <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
6.4
CVE-2024-53820
Dec 2, 2024
Researcher: theviper17y
Simple User Registration <= 5.5 - Missing Authorization to User Deletion
9.1
CVE-2024-53810
Dec 2, 2024
Researcher: stealthcopter
AIO Contact <= 2.8.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-54219
Dec 2, 2024
Researcher: Dave Jong
Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family'
6.1
CVE-2024-11200
Dec 2, 2024
Researcher: mike harris (mikeyh)
The Plus Addons for Elementor Page Builder Lite <= 5.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-53823
Dec 2, 2024
Researcher: wesley (wcraft)
WP Mailster <= 1.8.16.0 - Unauthenticated Information Exposure
5.3
CVE-2024-53804
Dec 2, 2024
Researcher: Mika
Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
6.1
CVE-2024-11252
Nov 29, 2024
Researcher: mikemyers
WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Button Width
4.4
CVE-2024-10555
Nov 29, 2024
Researcher: Dmitrii Ignatyev
Lenxel Core <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-53791
Nov 29, 2024
Researcher: João Pedro Soares de Alcântara
Lenxel Core <= 1.1 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2024-53790
Nov 29, 2024
Researcher: João Pedro Soares de Alcântara
WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Color
4.4
CVE-2024-8968
Nov 29, 2024
Researcher: Dmitrii Ignatyev
Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-10706
Nov 29, 2024
Researcher: Dmitrii Ignatyev
eDoc Easy Tables <= 1.29 - Cross-Site Request Forgery to SQL Injection
4.3
CVE-2024-53793
Nov 29, 2024
Researcher: João Pedro Soares de Alcântara
Watu Quiz <= 3.4.1.2 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2024-53792
Nov 29, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
Multilevel Referral Affiliate Plugin for WooCommerce <= 2.27 - Reflected Cross-Site Scripting
6.1
CVE-2024-53742
Nov 28, 2024
Researcher: João Pedro Soares de Alcântara
Mail Picker <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-53772
Nov 28, 2024
Researcher: SOPROBRO
SpatialMatch IDX <= 3.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-53781
Nov 28, 2024
Researcher: SOPROBRO
Elementor Button Plus <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-53746
Nov 28, 2024
Researcher: João Pedro Soares de Alcântara
Stripe Donation <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-53752
Nov 28, 2024
Researcher: SOPROBRO
WP Mermaid <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-53748
Nov 28, 2024
Researcher: theviper17y
Title CVE ID CVSS Researchers Date
Captivate Sync <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode CVE-2024-53820 6.4 theviper17y December 2, 2024
Simple User Registration <= 5.5 - Missing Authorization to User Deletion CVE-2024-53810 9.1 stealthcopter December 2, 2024
AIO Contact <= 2.8.1 - Unauthenticated Stored Cross-Site Scripting CVE-2024-54219 7.2 Dave Jong December 2, 2024
Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family' CVE-2024-11200 6.1 mike harris (mikeyh) December 2, 2024
The Plus Addons for Elementor Page Builder Lite <= 5.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-53823 6.4 wesley (wcraft) December 2, 2024
WP Mailster <= 1.8.16.0 - Unauthenticated Information Exposure CVE-2024-53804 5.3 Mika December 2, 2024
Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter CVE-2024-11252 6.1 mikemyers November 29, 2024
WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Button Width CVE-2024-10555 4.4 Dmitrii Ignatyev November 29, 2024
Lenxel Core <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-53791 6.4 João Pedro Soares de Alcântara November 29, 2024
Lenxel Core <= 1.1 - Authenticated (Contributor+) Local File Inclusion CVE-2024-53790 8.8 João Pedro Soares de Alcântara November 29, 2024
WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Color CVE-2024-8968 4.4 Dmitrii Ignatyev November 29, 2024
Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-10706 4.4 Dmitrii Ignatyev November 29, 2024
eDoc Easy Tables <= 1.29 - Cross-Site Request Forgery to SQL Injection CVE-2024-53793 4.3 João Pedro Soares de Alcântara November 29, 2024
Watu Quiz <= 3.4.1.2 - Authenticated (Contributor+) SQL Injection CVE-2024-53792 6.5 Trương Hữu Phúc (truonghuuphuc) November 29, 2024
Multilevel Referral Affiliate Plugin for WooCommerce <= 2.27 - Reflected Cross-Site Scripting CVE-2024-53742 6.1 João Pedro Soares de Alcântara November 28, 2024
Mail Picker <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-53772 6.4 SOPROBRO November 28, 2024
SpatialMatch IDX <= 3.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-53781 6.1 SOPROBRO November 28, 2024
Elementor Button Plus <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-53746 6.4 João Pedro Soares de Alcântara November 28, 2024
Stripe Donation <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-53752 6.4 SOPROBRO November 28, 2024
WP Mermaid <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-53748 6.4 theviper17y November 28, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Nov 27, 2024
Vulns
1 SOPROBRO 107
2 vgo0 58
3 Peter Thaleikis 54
4 João Pedro Soares de Alcântara 37
5 Mika 36
6 Francesco Carlucci 31
7 stealthcopter 21
8 zaim 20
9 theviper17y 19
10 Gab 15
11 thiennv 15
12 ardias 15
13 Arkadiusz Hydzik 14
14 Colin Xu 14
15 yudha 13
16 zakaria 13
17 Lucio Sá 12
18 Tieu Pham Trong Nhan 12
19 Trương Hữu Phúc (truonghuuphuc) 11
20 LVT-tholv2k 11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation