🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers, top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Theme Demo Import <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload

7.2

CVE-2023-28170

Aug 9, 2023

Researcher: deokhunKim

EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-4283

Aug 9, 2023

Researcher: István Márton

Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change

8.8

CVE-2023-4276

Aug 9, 2023

Researcher: István Márton

WxSync <= 2.7.24 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-39988

Aug 9, 2023

Researcher: Rio Darmawan

Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

8.8

CVE-2023-4239

Aug 8, 2023

Researcher: István Márton

ChatBot <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder

4.4

CVE-2023-4253

Aug 8, 2023

Researcher: Nguyen Hoang Nam

JCH Optimize <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification

4.3

CVE ID Unknown

Aug 8, 2023

Researchers:

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation

8.8

CVE-2023-4243

Aug 8, 2023

Researcher: Ram

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check

4.3

CVE-2023-4242

Aug 8, 2023

Researcher: Ram

Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Cross-Site Request Forgery to Course Modifications

4.3

CVE ID Unknown

Aug 8, 2023

Researchers:

ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings

4.4

CVE-2023-4254

Aug 8, 2023

Researcher: Bob Matyas

Paid Memberships Pro - Courses for Membership Add On <= 1.2.4 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE ID Unknown

Aug 8, 2023

Researchers:

Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation

5.3

CVE-2023-4059

Aug 8, 2023

Researcher: Mesh3l_911

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery

4.3

CVE ID Unknown

Aug 8, 2023

Researchers:

Biometric Login for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation

9.8

CVE ID Unknown

Aug 8, 2023

Researcher: Alexander Concha

Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Course Modifications

4.3

CVE-2023-39990

Aug 8, 2023

Researcher: Rafie Muhammad

User Activity Log <= 1.6.5 - Unauthenticated Data Export to Sensitive Information Disclosure

7.5

CVE-2023-4269

Aug 8, 2023

Researcher: Daniel Ruf

Photo Gallery by Ays <= 5.2.6 - Cross-Site Request Forgery

4.3

CVE-2023-39917

Aug 7, 2023

Researcher: Skalucy

All Users Messenger <= 1.24 - Authenticated (Subscriber+) Insecure Direct Object Reference to Message Deletion

5.4

CVE-2023-4023

Aug 7, 2023

Researcher: Dmitrii Ignatyev

User Activity Tracking and Log <= 4.0.8 - Cross-Site Request Forgery

4.3

CVE-2023-4150

Aug 7, 2023

Researcher: Erwan LR

Title	CVE ID	CVSS	Researchers	Date
Theme Demo Import <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload	CVE-2023-28170	7.2	deokhunKim	August 9, 2023
EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-4283	6.4	István Márton	August 9, 2023
Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change	CVE-2023-4276	8.8	István Márton	August 9, 2023
WxSync <= 2.7.24 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2023-39988	6.4	Rio Darmawan	August 9, 2023
Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation	CVE-2023-4239	8.8	István Márton	August 8, 2023
ChatBot <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder	CVE-2023-4253	4.4	Nguyen Hoang Nam	August 8, 2023
JCH Optimize <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification		4.3		August 8, 2023
FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation	CVE-2023-4243	8.8	Ram	August 8, 2023
FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check	CVE-2023-4242	4.3	Ram	August 8, 2023
Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Cross-Site Request Forgery to Course Modifications		4.3		August 8, 2023
ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings	CVE-2023-4254	4.4	Bob Matyas	August 8, 2023
Paid Memberships Pro - Courses for Membership Add On <= 1.2.4 - Authenticated (Admin+) Stored Cross-Site Scripting		4.4		August 8, 2023
Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation	CVE-2023-4059	5.3	Mesh3l_911	August 8, 2023
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery		4.3		August 8, 2023
Biometric Login for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation		9.8	Alexander Concha	August 8, 2023
Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Course Modifications	CVE-2023-39990	4.3	Rafie Muhammad	August 8, 2023
User Activity Log <= 1.6.5 - Unauthenticated Data Export to Sensitive Information Disclosure	CVE-2023-4269	7.5	Daniel Ruf	August 8, 2023
Photo Gallery by Ays <= 5.2.6 - Cross-Site Request Forgery	CVE-2023-39917	4.3	Skalucy	August 7, 2023
All Users Messenger <= 1.24 - Authenticated (Subscriber+) Insecure Direct Object Reference to Message Deletion	CVE-2023-4023	5.4	Dmitrii Ignatyev	August 7, 2023
User Activity Tracking and Log <= 4.0.8 - Cross-Site Request Forgery	CVE-2023-4150	4.3	Erwan LR	August 7, 2023

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Oct 3, 2024 Vulns
1	João Pedro Soares de Alcântara	52
2	István Márton	50
3	Francesco Carlucci	49
4	stealthcopter	46
5	vgo0	35
6	SOPROBRO	33
7	Mika	32
8	Peter Thaleikis	27
9	theviper17y	16
10	Trương Hữu Phúc (truonghuuphuc)	16
11	LVT-tholv2k	15
12	Rafie Muhammad	14
13	wesley (wcraft)	12
14	Colin Xu	10
15	Le Ngoc Anh	9
16	Hakiduck	9
17	Joshua Chan	8
18	Ankit Patel	8
19	TANG Cheuk Hei (siunam)	7
20	zer0gh0st	7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation