WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
My Geo Posts Free <= 1.2 - PHP Object Injection
9.8
CVE ID Unknown
Apr 27, 2017
Researchers:
AJAX Random Posts <= 0.3.3 - PHP Object Injection
9.8
CVE ID Unknown
Apr 27, 2017
Researchers:
Referrer Detector <= 4.2.1.0 - PHP Object Injection
9.8
CVE ID Unknown
Apr 27, 2017
Researchers:
Gravitate QA Tracker <= 1.2.1 - Object Injection
9.8
CVE-2017-18605
Apr 27, 2017
Researcher: Robert R
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Apr 26, 2017
Researcher: Karim Valiev
flickr-picture-backup <= 0.7 - Arbitrary file upload
9.8
CVE-2017-1002016
Apr 26, 2017
Researcher: Larry W. Cashdollar
Jetpack <= 4.0.2 - Cross-Site Scripting
6.1
CVE-2016-10706
Apr 26, 2017
Researchers:
Avada <= 5.1.4 - Stored Cross-Site Scripting
6.1
CVE-2017-18606
Apr 26, 2017
Researchers:
Avada <= 5.1.4 - Cross-Site Request Forgery
8.8
CVE-2017-18607
Apr 26, 2017
Researchers:
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection
9.6
CVE ID Unknown
Apr 26, 2017
Researchers:
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack
9.8
CVE ID Unknown
Apr 26, 2017
Researcher: Scott Arciszewski
cformsII <= 14.12.3 - Authenticated SQL Injection
7.2
CVE-2017-18570
Apr 24, 2017
Researchers:
WC Catalog Enquiry <= 3.0.5 - Arbitrary File Upload
9.8
CVE-2017-18592
Apr 20, 2017
Researchers:
myCred Plugin <= 1.7.7 - Reflected Cross-Site Scripting
6.1
CVE-2017-20008
Apr 20, 2017
Researcher: Jeremie Amsellem
Simple Job Board <= 2.4.4 - Reflected Cross-Site Scripting
6.1
CVE-2017-18498
Apr 19, 2017
Researchers:
Ultimate Form Builder Lite <= 1.3.2 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Apr 19, 2017
Researcher: 0xSec Team
AccessPress Social Icons <= 1.6.6 - Cross-Site Scripting
6.1
CVE ID Unknown
Apr 19, 2017
Researcher: Neven Birusk
Spot.IM Comments < 4.0.4 - Cross-Site Scripting
6.1
CVE-2017-18608
Apr 19, 2017
Researchers:
Social Buttons Pack by BestWebSoft < 1.1.1 - Reflected Cross-Site Scripting
6.1
CVE-2017-18500
Apr 17, 2017
Researcher: Neven Birusk
Ultimate Member <= 1.3.83 - Shortcode Injection
9.8
CVE ID Unknown
Apr 17, 2017
Researcher: James Golovich
Title CVE ID CVSS Researchers Date
My Geo Posts Free <= 1.2 - PHP Object Injection 9.8 April 27, 2017
AJAX Random Posts <= 0.3.3 - PHP Object Injection 9.8 April 27, 2017
Referrer Detector <= 4.2.1.0 - PHP Object Injection 9.8 April 27, 2017
Gravitate QA Tracker <= 1.2.1 - Object Injection CVE-2017-18605 9.8 Robert R April 27, 2017
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting 6.1 Karim Valiev April 26, 2017
flickr-picture-backup <= 0.7 - Arbitrary file upload CVE-2017-1002016 9.8 Larry W. Cashdollar April 26, 2017
Jetpack <= 4.0.2 - Cross-Site Scripting CVE-2016-10706 6.1 April 26, 2017
Avada <= 5.1.4 - Stored Cross-Site Scripting CVE-2017-18606 6.1 April 26, 2017
Avada <= 5.1.4 - Cross-Site Request Forgery CVE-2017-18607 8.8 April 26, 2017
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection 9.6 April 26, 2017
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack 9.8 Scott Arciszewski April 26, 2017
cformsII <= 14.12.3 - Authenticated SQL Injection CVE-2017-18570 7.2 April 24, 2017
WC Catalog Enquiry <= 3.0.5 - Arbitrary File Upload CVE-2017-18592 9.8 April 20, 2017
myCred Plugin <= 1.7.7 - Reflected Cross-Site Scripting CVE-2017-20008 6.1 Jeremie Amsellem April 20, 2017
Simple Job Board <= 2.4.4 - Reflected Cross-Site Scripting CVE-2017-18498 6.1 April 19, 2017
Ultimate Form Builder Lite <= 1.3.2 - Reflected Cross-Site Scripting 6.1 0xSec Team April 19, 2017
AccessPress Social Icons <= 1.6.6 - Cross-Site Scripting 6.1 Neven Birusk April 19, 2017
Spot.IM Comments < 4.0.4 - Cross-Site Scripting CVE-2017-18608 6.1 April 19, 2017
Social Buttons Pack by BestWebSoft < 1.1.1 - Reflected Cross-Site Scripting CVE-2017-18500 6.1 Neven Birusk April 17, 2017
Ultimate Member <= 1.3.83 - Shortcode Injection 9.8 James Golovich April 17, 2017
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 23, 2024
Vulns
1 Francesco Carlucci 66
2 vgo0 56
3 João Pedro Soares de Alcântara 49
4 stealthcopter 35
5 István Márton 35
6 SOPROBRO 26
7 Peter Thaleikis 21
8 Le Ngoc Anh 18
9 LVT-tholv2k 14
10 Robert DeVore 14
11 Trương Hữu Phúc (truonghuuphuc) 13
12 Rafie Muhammad 13
13 Colin Xu 12
14 wesley (wcraft) 12
15 tahu.datar 12
16 theviper17y 12
17 Mika 11
18 Khalid Yusuf 11
19 Joshua Chan 10
20 Webbernaut 9

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation