WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
HTTP Headers <= 1.18.11 - Server-Side Request Forgery
5.5
CVE-2023-37978
Jul 13, 2023
Researcher: emad
Buy Me a Coffee – Button and Widget Plugin <= 3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2023-2082
Jul 13, 2023
Researcher: István Márton
Integration for Contact Form 7 and Salesforce <= 1.3.3 - Open Redirect
7.1
CVE-2023-37982
Jul 13, 2023
Researcher: Le Hong Minh
Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-37980
Jul 13, 2023
Researcher: Rio Darmawan
MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject
7.2
CVE-2023-3136
Jul 12, 2023
Researcher: Alex Thomas
WP-FB-AutoConnect <= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page
5.4
CVE-2023-37974
Jul 12, 2023
Researcher: Nguyen Xuan Chien
DirectoryPress <= 3.6.2 - Missing Authorization
7.3
CVE-2023-37967
Jul 12, 2023
Researcher: Abdi Pranata
Radio Forge Muses Player with Skins <= 2.5 - Reflected Cross-Site Scripting
7.2
CVE-2023-37976
Jul 12, 2023
Researcher: Le Hong Minh
Variation Images Gallery for WooCommerce <= 2.3.3 - Reflected Cross-Site Scripting via style
6.1
CVE-2023-37894
Jul 12, 2023
Researcher: Nguyen Xuan Chien
Falang multilanguage <= 1.3.39 - Cross-Site Request Forgery via add_language
5.4
CVE-2023-37968
Jul 12, 2023
Researcher: Skalucy
WooCommerce Product Stock Alert <= 2.0.1 - Information Disclosure
5.3
CVE-2023-37972
Jul 12, 2023
Researcher: Mika
Coming Soon Chop Chop <= 2.2.4 - Reflected Cross-Site Scripting
6.1
CVE-2023-37893
Jul 12, 2023
Researcher: Phd
MF Gig Calendar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time
6.4
CVE-2023-37970
Jul 12, 2023
Researcher: Abdi Pranata
FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-24410
Jul 12, 2023
Researcher: Ravi Dharmawan
Replace Word <= 2.1 - Cross-Site Request Forgery
4.3
CVE-2023-37973
Jul 12, 2023
Researcher: Yuki Haruma
Variation Swatches for WooCommerce <= 2.3.7 - Reflected Cross-Site Scripting
6.1
CVE-2023-37975
Jul 12, 2023
Researcher: Phd
Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints
7.3
CVE-2023-32117
Jul 12, 2023
Researcher: Abdi Pranata
Zippy <= 1.6.2 - Missing Authorization via adminInit
6.5
CVE-2023-34381
Jul 12, 2023
Researcher: Emili Castells
Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting
6.1
CVE-2023-34010
Jul 12, 2023
Researcher: Phd
User Activity Log <= 1.6.2 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2023-37966
Jul 12, 2023
Researcher: LEE SE HYOUNG
Title CVE ID CVSS Researchers Date
HTTP Headers <= 1.18.11 - Server-Side Request Forgery CVE-2023-37978 5.5 emad July 13, 2023
Buy Me a Coffee – Button and Widget Plugin <= 3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2023-2082 6.4 István Márton July 13, 2023
Integration for Contact Form 7 and Salesforce <= 1.3.3 - Open Redirect CVE-2023-37982 7.1 Le Hong Minh July 13, 2023
Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-37980 4.4 Rio Darmawan July 13, 2023
MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject CVE-2023-3136 7.2 Alex Thomas July 12, 2023
WP-FB-AutoConnect <= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page CVE-2023-37974 5.4 Nguyen Xuan Chien July 12, 2023
DirectoryPress <= 3.6.2 - Missing Authorization CVE-2023-37967 7.3 Abdi Pranata July 12, 2023
Radio Forge Muses Player with Skins <= 2.5 - Reflected Cross-Site Scripting CVE-2023-37976 7.2 Le Hong Minh July 12, 2023
Variation Images Gallery for WooCommerce <= 2.3.3 - Reflected Cross-Site Scripting via style CVE-2023-37894 6.1 Nguyen Xuan Chien July 12, 2023
Falang multilanguage <= 1.3.39 - Cross-Site Request Forgery via add_language CVE-2023-37968 5.4 Skalucy July 12, 2023
WooCommerce Product Stock Alert <= 2.0.1 - Information Disclosure CVE-2023-37972 5.3 Mika July 12, 2023
Coming Soon Chop Chop <= 2.2.4 - Reflected Cross-Site Scripting CVE-2023-37893 6.1 Phd July 12, 2023
MF Gig Calendar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time CVE-2023-37970 6.4 Abdi Pranata July 12, 2023
FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection CVE-2023-24410 7.2 Ravi Dharmawan July 12, 2023
Replace Word <= 2.1 - Cross-Site Request Forgery CVE-2023-37973 4.3 Yuki Haruma July 12, 2023
Variation Swatches for WooCommerce <= 2.3.7 - Reflected Cross-Site Scripting CVE-2023-37975 6.1 Phd July 12, 2023
Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints CVE-2023-32117 7.3 Abdi Pranata July 12, 2023
Zippy <= 1.6.2 - Missing Authorization via adminInit CVE-2023-34381 6.5 Emili Castells July 12, 2023
Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting CVE-2023-34010 6.1 Phd July 12, 2023
User Activity Log <= 1.6.2 - Authenticated (Administrator+) SQL Injection CVE-2023-37966 7.2 LEE SE HYOUNG July 12, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 20, 2024
Vulns
1 stealthcopter 25
2 wesley (wcraft) 21
3 Francesco Carlucci 20
4 Lucio Sá 19
5 Daniel Ruf 16
6 vgo0 15
7 Rafie Muhammad 12
8 Dave Jong 11
9 Ananda Dhakal 9
10 Marco Wotschka 8
11 Peter Thaleikis 6
12 Muhammad Daffa 6
13 Krzysztof Zając 6
14 João Pedro Soares de Alcântara 5
15 Webbernaut 5
16 Bob Matyas 5
17 Le Ngoc Anh 5
18 Fariq Fadillah Gusti Insani (fariqfgi) 5
19 rezaduty 4
20 LVT-tholv2k 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation