🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers, top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

WP Remote Upload <= 1.2.1 - Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVE ID Unknown

Jun 12, 2016

Researcher: Bini Shala

Search Everything <= 8.1.5 - SQL Injection

9.8

CVE-2016-10917

Jun 10, 2016

Researchers:

CM Ad Changer <= 1.7.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting

8.8

CVE ID Unknown

Jun 9, 2016

Researcher: Aaditya Purani

EWWW Image Optimizer <= 2.8.4 - Remote Code Execution

9.6

CVE-2016-20010

Jun 8, 2016

Researcher: Sean Murphy

Blaze Slide Show <= 2.7 - Arbitrary File upload

9.8

CVE ID Unknown

Jun 7, 2016

Researchers:

Levo Slideshow <= 2.3 - Cross-Site Scripting

6.4

CVE ID Unknown

Jun 6, 2016

Researchers: Aaditya Purani, Vulnerability Lab

Newspaper - News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting

6.5

CVE-2017-18634

Jun 6, 2016

Researcher: WP0DAY.COM

OneLogin SAML-SSO Plugin < 2.1.6 - Authentication Bypass

9.8

CVE ID Unknown

Jun 6, 2016

Researcher: Jouko Pynnöne

Newspaper - News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update

9.8

CVE-2016-10972

Jun 6, 2016

Researcher: WP0DAY.COM

Double Opt-In for Download <= 2.0.9 - SQL Injection

8.8

CVE ID Unknown

Jun 6, 2016

Researcher: Kacper Szurek

WP Mobile Detector <= 3.5 - Arbitrary File Upload

9.8

CVE ID Unknown

Jun 3, 2016

Researcher: Aaditya Purani

CMS Commander – Manage Multiple Sites Plugin <= 2.21 - PHP Object Injection

8.5

CVE ID Unknown

Jun 1, 2016

Researcher: Yorick Koster,

Stream <= 3.0.5 - Sensitive Data Exposure

7.5

CVE ID Unknown

May 31, 2016

Researcher: James Golovich

Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

May 30, 2016

Researcher: Kacper Szurek

Gallery - Video Gallery and YouTube Gallery <= 1.7.01 - Stored Cross-Site Scripting

6.4

CVE ID Unknown

May 28, 2016

Researcher: Oliveira Lima

Kento Post View Counter <= 2.8 - SQL Injection

9.8

CVE-2016-15040

May 26, 2016

Researchers:

Crowdsignal Dashboard – Polls, Surveys & more <= 2.0.31 - Stored Cross-Site scripting

6.4

CVE ID Unknown

May 26, 2016

Researchers:

Markdown on Save Improved <= 2.5 - Stored Cross-Site Scripting

6.1

CVE-2017-9337

May 25, 2016

Researcher: Kenta Yamamoto

Markdown on Save Improved <= 2.5 - Stored Cross-Site Scripting

6.1

CVE-2016-4812

May 25, 2016

Researcher: Kenta Yamamoto

WP Fastest Cache <= 0.8.5.7 - Local File Inclusion

8.8

CVE ID Unknown

May 24, 2016

Researcher: Panagiotis Vagenas

Title	CVE ID	CVSS	Researchers	Date
WP Remote Upload <= 1.2.1 - Cross-Site Request Forgery to Arbitrary File Upload		8.8	Bini Shala	June 12, 2016
Search Everything <= 8.1.5 - SQL Injection	CVE-2016-10917	9.8		June 10, 2016
CM Ad Changer <= 1.7.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting		8.8	Aaditya Purani	June 9, 2016
EWWW Image Optimizer <= 2.8.4 - Remote Code Execution	CVE-2016-20010	9.6	Sean Murphy	June 8, 2016
Blaze Slide Show <= 2.7 - Arbitrary File upload		9.8		June 7, 2016
Levo Slideshow <= 2.3 - Cross-Site Scripting		6.4	Aaditya Purani, Vulnerability Lab	June 6, 2016
Newspaper - News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting	CVE-2017-18634	6.5	WP0DAY.COM	June 6, 2016
OneLogin SAML-SSO Plugin < 2.1.6 - Authentication Bypass		9.8	Jouko Pynnöne	June 6, 2016
Newspaper - News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update	CVE-2016-10972	9.8	WP0DAY.COM	June 6, 2016
Double Opt-In for Download <= 2.0.9 - SQL Injection		8.8	Kacper Szurek	June 6, 2016
WP Mobile Detector <= 3.5 - Arbitrary File Upload		9.8	Aaditya Purani	June 3, 2016
CMS Commander – Manage Multiple Sites Plugin <= 2.21 - PHP Object Injection		8.5	Yorick Koster,	June 1, 2016
Stream <= 3.0.5 - Sensitive Data Exposure		7.5	James Golovich	May 31, 2016
Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting		6.1	Kacper Szurek	May 30, 2016
Gallery - Video Gallery and YouTube Gallery <= 1.7.01 - Stored Cross-Site Scripting		6.4	Oliveira Lima	May 28, 2016
Kento Post View Counter <= 2.8 - SQL Injection	CVE-2016-15040	9.8		May 26, 2016
Crowdsignal Dashboard – Polls, Surveys & more <= 2.0.31 - Stored Cross-Site scripting		6.4		May 26, 2016
Markdown on Save Improved <= 2.5 - Stored Cross-Site Scripting	CVE-2017-9337	6.1	Kenta Yamamoto	May 25, 2016
Markdown on Save Improved <= 2.5 - Stored Cross-Site Scripting	CVE-2016-4812	6.1	Kenta Yamamoto	May 25, 2016
WP Fastest Cache <= 0.8.5.7 - Local File Inclusion		8.8	Panagiotis Vagenas	May 24, 2016

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Sep 22, 2024 Vulns
1	Francesco Carlucci	70
2	vgo0	59
3	João Pedro Soares de Alcântara	37
4	István Márton	35
5	stealthcopter	26
6	SOPROBRO	25
7	Peter Thaleikis	22
8	Le Ngoc Anh	18
9	Robert DeVore	15
10	wesley (wcraft)	13
11	Rafie Muhammad	13
12	Trương Hữu Phúc (truonghuuphuc)	13
13	Colin Xu	12
14	LVT-tholv2k	12
15	tahu.datar	12
16	Khalid Yusuf	11
17	theviper17y	11
18	Joshua Chan	10
19	Abdi Pranata	9
20	TANG Cheuk Hei (siunam)	9

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation