WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Contact Form Manager <= 1.4.3 - Cross-Site Scripting
6.1
CVE-2017-20054
Mar 1, 2017
Researcher: Edwin Molenaar
Bit File Manager <= 4.1.4 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE ID Unknown
Mar 1, 2017
Researcher: David Vaartjes
User Login Log <= 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2017-20056
Mar 1, 2017
Researcher: Axel Koolhaas
Admin Custom Login <= 2.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
8.8
CVE ID Unknown
Mar 1, 2017
Researcher: Burak Kelebek
WP-SpamFree Anti-Spam <= 2.1.1.6 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Mar 1, 2017
Researcher: Radjnies Bhansingh
Relevanssi – A Better Search <= 3.5.7.1 - Stored Cross-Site Scripting
6.1
CVE-2017-1000038
Feb 28, 2017
Researcher: Mallory Adams
Wordpress Plugin Mobile App Native 3.0 <= 3.0 - Arbitrary File Upload
9.8
CVE-2017-6104
Feb 28, 2017
Researcher: Larry W. Cashdollar
Kama Click Counter <= 3.4.9 - Blind SQL Injection
8.1
CVE-2017-18614
Feb 27, 2017
Researcher: Manuel Garcia Cardenas
Kama Click Counter <= 3.4.9 - Cross-Site Scripting
6.1
CVE-2017-18615
Feb 27, 2017
Researchers:
GD Rating System < 2.1 - Reflected Cross-Site Scripting
6.1
CVE-2017-18591
Feb 23, 2017
Researcher: Haojun Hou in ADLab of Venustech
Democracy Poll <= 5.3.6 - Cross-Site Request Forgery
8.8
CVE-2017-18521
Feb 23, 2017
Researchers:
Democracy Poll < 5.4 - Cross-Site Scripting
6.1
CVE-2017-18520
Feb 22, 2017
Researchers:
AnyVar <= 0.1.1 - Cross-Site Scripting
6.1
CVE-2017-6103
Feb 20, 2017
Researcher: Larry W. Cashdollar
Time Sheets < 1.5.2 - Cross-Site Scripting
6.1
CVE-2017-18582
Feb 19, 2017
Researchers:
Fast Image Adder < 1.2 - Arbitrary File Upload
9.8
CVE-2015-1000001
Feb 19, 2017
Researcher: Larry W. Cashdollar
Mail Masta <= 1.0 - SQL Injection via camp_id parameter
7.2
CVE-2017-6097
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via id parameter
7.2
CVE-2017-6573
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via id parameter
7.2
CVE-2017-6571
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via filter_list parameter
7.2
CVE-2017-6096
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via list_id parameter
7.2
CVE-2017-6098
Feb 18, 2017
Researcher: Hanley Shun
Title CVE ID CVSS Researchers Date
Contact Form Manager <= 1.4.3 - Cross-Site Scripting CVE-2017-20054 6.1 Edwin Molenaar March 1, 2017
Bit File Manager <= 4.1.4 - Cross-Site Request Forgery to Arbitrary File Upload 8.8 David Vaartjes March 1, 2017
User Login Log <= 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2017-20056 6.4 Axel Koolhaas March 1, 2017
Admin Custom Login <= 2.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting 8.8 Burak Kelebek March 1, 2017
WP-SpamFree Anti-Spam <= 2.1.1.6 - Reflected Cross-Site Scripting 6.1 Radjnies Bhansingh March 1, 2017
Relevanssi – A Better Search <= 3.5.7.1 - Stored Cross-Site Scripting CVE-2017-1000038 6.1 Mallory Adams February 28, 2017
Wordpress Plugin Mobile App Native 3.0 <= 3.0 - Arbitrary File Upload CVE-2017-6104 9.8 Larry W. Cashdollar February 28, 2017
Kama Click Counter <= 3.4.9 - Blind SQL Injection CVE-2017-18614 8.1 Manuel Garcia Cardenas February 27, 2017
Kama Click Counter <= 3.4.9 - Cross-Site Scripting CVE-2017-18615 6.1 February 27, 2017
GD Rating System < 2.1 - Reflected Cross-Site Scripting CVE-2017-18591 6.1 Haojun Hou in ADLab of Venustech February 23, 2017
Democracy Poll <= 5.3.6 - Cross-Site Request Forgery CVE-2017-18521 8.8 February 23, 2017
Democracy Poll < 5.4 - Cross-Site Scripting CVE-2017-18520 6.1 February 22, 2017
AnyVar <= 0.1.1 - Cross-Site Scripting CVE-2017-6103 6.1 Larry W. Cashdollar February 20, 2017
Time Sheets < 1.5.2 - Cross-Site Scripting CVE-2017-18582 6.1 February 19, 2017
Fast Image Adder < 1.2 - Arbitrary File Upload CVE-2015-1000001 9.8 Larry W. Cashdollar February 19, 2017
Mail Masta <= 1.0 - SQL Injection via camp_id parameter CVE-2017-6097 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via id parameter CVE-2017-6573 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via id parameter CVE-2017-6571 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via filter_list parameter CVE-2017-6096 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via list_id parameter CVE-2017-6098 7.2 Hanley Shun February 18, 2017
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 23, 2024
Vulns
1 Francesco Carlucci 65
2 vgo0 55
3 João Pedro Soares de Alcântara 42
4 stealthcopter 35
5 István Márton 35
6 SOPROBRO 25
7 Peter Thaleikis 21
8 Le Ngoc Anh 18
9 Robert DeVore 14
10 Rafie Muhammad 13
11 Trương Hữu Phúc (truonghuuphuc) 13
12 Colin Xu 12
13 LVT-tholv2k 12
14 tahu.datar 12
15 wesley (wcraft) 11
16 theviper17y 11
17 Khalid Yusuf 11
18 Joshua Chan 10
19 Hakiduck 9
20 TANG Cheuk Hei (siunam) 9

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation