🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion

6.5

CVE-2023-2173

Jul 5, 2023

Researcher: Alex Thomas

WP Dummy Content Generator <= 2.3.0 - Missing Authorization

5.3

CVE-2023-37394

Jul 5, 2023

Researcher: thiennv

WP Dummy Content Generator <= 2.3.0 - Cross-Site Request Forgery

4.3

CVE-2023-37392

Jul 5, 2023

Researcher: Elliot

WP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject

7.2

CVE-2023-3168

Jul 5, 2023

Researcher: Alex Thomas

WooLentor <= 2.6.2 - Cross-Site Request Forgery via process_data

4.3

CVE-2022-47172

Jul 5, 2023

Researcher: Muhammad Daffa

BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite

4.3

CVE-2023-2172

Jul 5, 2023

Researcher: Alex Thomas

Media Library Helper by Codexin <= 1.2.0 - Cross-Site Request Forgery via rate_the_plugin_action

4.3

CVE-2023-37386

Jul 5, 2023

Researcher: István Márton

Classified Listing <= 2.4.5 - Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete

4.3

CVE-2023-37387

Jul 5, 2023

Researcher: István Márton

WP Full Stripe Free <= 7.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-28934

Jul 5, 2023

Researcher: easyBug

WPLMS < 4.900 - Cross-Site Request Forgery

6.3

CVE-2023-36690

Jul 5, 2023

Researcher: Dave Jong

Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-37388

Jul 5, 2023

Researcher: Yuki Haruma

Coming Soon Page <= 1.5.9 - Authenticated (Administrator+) SQL Injection

7.2

CVE-2022-46849

Jul 5, 2023

Researcher: Le Ngoc Anh

Visibility Logic for Elementor <= 2.3.4 - Cross-Site Request Forgery via toggle_option

4.3

CVE-2022-47169

Jul 5, 2023

Researcher: Muhammad Daffa

ARMember <= 4.0.5 - Cross-Site Request Forgery

6.5

CVE-2023-3011

Jul 5, 2023

Researcher: Alex Thomas

Visibility Logic for Elementor <= 2.3.4 - Missing Authorization via admin_post 'toggle_option'

4.3

CVE ID Unknown

Jul 5, 2023

Researchers:

BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

5.4

CVE-2023-2171

Jul 5, 2023

Researcher: Alex Thomas

Livestream Notice <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-27621

Jul 5, 2023

Researcher: Pavitra Tiwari

BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries

4.3

CVE-2023-2174

Jul 5, 2023

Researcher: Alex Thomas

Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

9.8

CVE-2023-37389

Jul 5, 2023

Researcher: Rafie Muhammad

RSVPMaker <= 10.5.4 - Authenticated (Administrator+) SQL Injection via 'resend'

7.2

CVE-2023-29095

Jul 5, 2023

Researcher: Rafi Priatna Kasbiantoro

Title	CVE ID	CVSS	Researchers	Date
BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion	CVE-2023-2173	6.5	Alex Thomas	July 5, 2023
WP Dummy Content Generator <= 2.3.0 - Missing Authorization	CVE-2023-37394	5.3	thiennv	July 5, 2023
WP Dummy Content Generator <= 2.3.0 - Cross-Site Request Forgery	CVE-2023-37392	4.3	Elliot	July 5, 2023
WP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject	CVE-2023-3168	7.2	Alex Thomas	July 5, 2023
WooLentor <= 2.6.2 - Cross-Site Request Forgery via process_data	CVE-2022-47172	4.3	Muhammad Daffa	July 5, 2023
BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite	CVE-2023-2172	4.3	Alex Thomas	July 5, 2023
Media Library Helper by Codexin <= 1.2.0 - Cross-Site Request Forgery via rate_the_plugin_action	CVE-2023-37386	4.3	István Márton	July 5, 2023
Classified Listing <= 2.4.5 - Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete	CVE-2023-37387	4.3	István Márton	July 5, 2023
WP Full Stripe Free <= 7.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-28934	4.4	easyBug	July 5, 2023
WPLMS < 4.900 - Cross-Site Request Forgery	CVE-2023-36690	6.3	Dave Jong	July 5, 2023
Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-37388	4.4	Yuki Haruma	July 5, 2023
Coming Soon Page <= 1.5.9 - Authenticated (Administrator+) SQL Injection	CVE-2022-46849	7.2	Le Ngoc Anh	July 5, 2023
Visibility Logic for Elementor <= 2.3.4 - Cross-Site Request Forgery via toggle_option	CVE-2022-47169	4.3	Muhammad Daffa	July 5, 2023
ARMember <= 4.0.5 - Cross-Site Request Forgery	CVE-2023-3011	6.5	Alex Thomas	July 5, 2023
Visibility Logic for Elementor <= 2.3.4 - Missing Authorization via admin_post 'toggle_option'		4.3		July 5, 2023
BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2023-2171	5.4	Alex Thomas	July 5, 2023
Livestream Notice <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-27621	4.4	Pavitra Tiwari	July 5, 2023
BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries	CVE-2023-2174	4.3	Alex Thomas	July 5, 2023
Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset	CVE-2023-37389	9.8	Rafie Muhammad	July 5, 2023
RSVPMaker <= 10.5.4 - Authenticated (Administrator+) SQL Injection via 'resend'	CVE-2023-29095	7.2	Rafi Priatna Kasbiantoro	July 5, 2023

Submit Vulnerability

«
‹
1
2
...
460
461
462
...
1016
1017
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Oct 20, 2024 Vulns
1	SOPROBRO	211
2	João Pedro Soares de Alcântara	61
3	Francesco Carlucci	55
4	Gab	44
5	stealthcopter	40
6	Peter Thaleikis	40
7	István Márton	35
8	Mika	29
9	vgo0	28
10	LVT-tholv2k	23
11	Trương Hữu Phúc (truonghuuphuc)	16
12	wesley (wcraft)	15
13	theviper17y	14
14	zer0gh0st	13
15	Arkadiusz Hydzik	12
16	Tonn	12
17	Tieu Pham Trong Nhan	9
18	incognito	8
19	Webbernaut	8
20	Rafie Muhammad	8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation