🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Product Size Chart For WooCommerce <= 1.1.5 - Cross-Site Request Forgery via get_save_option

6.5

CVE-2023-48778

Nov 28, 2023

Researcher: qilin_99

Formzu WP <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id

6.4

CVE-2023-49160

Nov 28, 2023

Researcher: resecured.io

Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action

7.3

CVE-2023-48760

Nov 28, 2023

Researcher: Rafie Muhammad

Business Directory Plugin <= 6.3.10 - Cross-Site Request Forgery

4.3

CVE-2023-5803

Nov 28, 2023

Researcher: Brandon James Roldan (tomorrowisnew)

Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization

6.3

CVE-2023-48761

Nov 28, 2023

Researcher: Rafie Muhammad

BSK Forms Blacklist <= 3.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-5980

Nov 28, 2023

Researcher: Bob Matyas

WP Mail Log <= 1.1.2 - Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion

6.4

CVE-2023-5644

Nov 28, 2023

Researcher: dc11

Google Calendar Events <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVE-2023-49151

Nov 28, 2023

Researcher: Abdi Pranata

GoDaddy Email Marketing <= 1.4.3 - Missing Authorization

4.3

CVE-2023-49156

Nov 28, 2023

Researcher: Abdi Pranata

WP Crowdfunding <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-5757

Nov 28, 2023

Researcher: David Suho Lee

SchedulePress <= 5.0.4 - Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications

4.3

CVE ID Unknown

Nov 28, 2023

Researchers:

Add to Cart Text Changer and Customize Button, Add Custom Icon <= 2.0 - Cross-Site Request Forgery via wactc_text_form

4.3

CVE-2023-49153

Nov 28, 2023

Researcher: Skalucy

JetElements For Elementor <= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download

5.3

CVE-2023-48759

Nov 28, 2023

Researcher: Rafie Muhammad

Multiple Post Passwords <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-49157

Nov 28, 2023

Researcher: DoYeon Park (p6rkdoye0n)

LadiApp <= 4.3 - Missing Authorization

4.3

CVE-2023-49158

Nov 28, 2023

Researcher: Truoc Phan

WP Mail Log <= 1.1.2 - Authenticated (Contributor+) Arbitrary File Read

6.5

CVE-2023-5672

Nov 28, 2023

Researcher: dc11

Accelerated Mobile Pages <= 1.0.88.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVE-2023-48321

Nov 28, 2023

Researcher: Ngô Thiên An (ancorn_)

Currency Converter Calculator <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVE-2023-49149

Nov 28, 2023

Researcher: Ngô Thiên An (ancorn_)

MkRapel Regiones y Ciudades de Chile para WC <= 4.3.0 - Cross-Site Request Forgery via multiple functions

6.5

CVE-2023-48781

Nov 28, 2023

Researcher: qilin_99

Media File Renamer <= 5.6.9 - Sensitive Information Exposure via Log File

5.3

CVE-2023-44991

Nov 28, 2023

Researcher: Joshua Chan

Title	CVE ID	CVSS	Researchers	Date
Product Size Chart For WooCommerce <= 1.1.5 - Cross-Site Request Forgery via get_save_option	CVE-2023-48778	6.5	qilin_99	November 28, 2023
Formzu WP <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id	CVE-2023-49160	6.4	resecured.io	November 28, 2023
Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action	CVE-2023-48760	7.3	Rafie Muhammad	November 28, 2023
Business Directory Plugin <= 6.3.10 - Cross-Site Request Forgery	CVE-2023-5803	4.3	Brandon James Roldan (tomorrowisnew)	November 28, 2023
Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization	CVE-2023-48761	6.3	Rafie Muhammad	November 28, 2023
BSK Forms Blacklist <= 3.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-5980	4.4	Bob Matyas	November 28, 2023
WP Mail Log <= 1.1.2 - Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion	CVE-2023-5644	6.4	dc11	November 28, 2023
Google Calendar Events <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode	CVE-2023-49151	6.4	Abdi Pranata	November 28, 2023
GoDaddy Email Marketing <= 1.4.3 - Missing Authorization	CVE-2023-49156	4.3	Abdi Pranata	November 28, 2023
WP Crowdfunding <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-5757	4.4	David Suho Lee	November 28, 2023
SchedulePress <= 5.0.4 - Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications		4.3		November 28, 2023
Add to Cart Text Changer and Customize Button, Add Custom Icon <= 2.0 - Cross-Site Request Forgery via wactc_text_form	CVE-2023-49153	4.3	Skalucy	November 28, 2023
JetElements For Elementor <= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download	CVE-2023-48759	5.3	Rafie Muhammad	November 28, 2023
Multiple Post Passwords <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-49157	4.4	DoYeon Park (p6rkdoye0n)	November 28, 2023
LadiApp <= 4.3 - Missing Authorization	CVE-2023-49158	4.3	Truoc Phan	November 28, 2023
WP Mail Log <= 1.1.2 - Authenticated (Contributor+) Arbitrary File Read	CVE-2023-5672	6.5	dc11	November 28, 2023
Accelerated Mobile Pages <= 1.0.88.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode	CVE-2023-48321	6.4	Ngô Thiên An (ancorn_)	November 28, 2023
Currency Converter Calculator <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode	CVE-2023-49149	6.4	Ngô Thiên An (ancorn_)	November 28, 2023
MkRapel Regiones y Ciudades de Chile para WC <= 4.3.0 - Cross-Site Request Forgery via multiple functions	CVE-2023-48781	6.5	qilin_99	November 28, 2023
Media File Renamer <= 5.6.9 - Sensitive Information Exposure via Log File	CVE-2023-44991	5.3	Joshua Chan	November 28, 2023

Submit Vulnerability

«
‹
1
2
...
365
366
367
...
1013
1014
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Oct 16, 2024 Vulns
1	SOPROBRO	215
2	João Pedro Soares de Alcântara	73
3	Francesco Carlucci	55
4	stealthcopter	46
5	Gab	46
6	István Márton	36
7	Peter Thaleikis	35
8	Mika	34
9	vgo0	26
10	LVT-tholv2k	25
11	wesley (wcraft)	15
12	theviper17y	15
13	zer0gh0st	13
14	Trương Hữu Phúc (truonghuuphuc)	12
15	Tonn	11
16	Ankit Patel	8
17	Webbernaut	8
18	Rafie Muhammad	8
19	Le Ngoc Anh	8
20	Tieu Pham Trong Nhan	8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation