💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

WatuPRO < 4.9.0.8 - Cross-Site Request Forgery

4.3

CVE-2015-9418

Sep 1, 2015

Researcher: Mallory Adams

CKEditor for WordPress <= 4.5.3 - Reflected Cross-Site Scripting

6.1

CVE-2015-9349

Aug 31, 2015

Researcher: Marcin Probola

NextGen Gallery <= 2.1.9 - Cross-Site Scripting

6.4

CVE-2015-9537

Aug 31, 2015

Researcher: Sathish Kumar

sourceAFRICA <= 0.1.3 - Cross-Site Scripting

6.1

CVE-2015-6920

Aug 29, 2015

Researcher: Ehsan Hosseini

Responsive Thumbnail Slider < 1.0.1 - Arbitrary File Upload

8.8

CVE ID Unknown

Aug 29, 2015

Researcher: Arash Khazaei

Job Manager <= 0.7.25 - Insecure Direct Object Reference

7.5

CVE-2015-6668

Aug 28, 2015

Researcher: Evangelos Mourikis

NextGen Gallery <= 2.1.7 - Path Traversal

6.5

CVE ID Unknown

Aug 28, 2015

Researcher: Sathish Kumar

Captain Slider <= 1.0.6 - Stored Cross-Site Scripting

6.1

CVE-2015-9419

Aug 28, 2015

Researcher: Arash Khazaei

NextGen Gallery <= 2.1.10 - Local File Inclusion

6.5

CVE-2015-9538

Aug 28, 2015

Researcher: Sathish Kumar

YouTube Embed <= 3.3.2 - Cross-Site Scripting

5.5

CVE-2015-6535

Aug 26, 2015

Researchers:

Navis DocumentCloud < 0.1.1 - Reflected Cross-Site Scripting

6.1

CVE-2015-2807

Aug 26, 2015

Researcher: Harry Metcalfe (DXW)

Car Rental System < 3.1 - SQL Injection

9.8

CVE ID Unknown

Aug 26, 2015

Researcher: Manish Kishan Tanwar

Smart Slider 2 <= 2.3.11 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

Aug 26, 2015

Researcher: Marcin Probola

Role Scoper <= 1.3.64 - Reflected Cross-Site Scripting

7.1

CVE ID Unknown

Aug 26, 2015

Researcher: Marcin Probola

Simple Slideshow Manager <= 2.1 - Cross-Site Request Forgery

7.3

CVE ID Unknown

Aug 26, 2015

Researchers:

SoundCloud Is Gold <= 2.3.1 - Reflected Cross-Site Scripting

6.1

CVE-2015-9420

Aug 26, 2015

Researcher: Marcin Probola

Private Only <= 3.5.1 - Multiple Cross-Site Request Forgery

8.8

CVE-2015-5483

Aug 26, 2015

Researchers: Mallory Adams, dwxsupport

GoCodes <= 1.3.5 - Authenticated Blind SQL Injection

8.8

CVE-2015-9398

Aug 25, 2015

Researcher: Marcin Probola

Simple Fields <= 1.4.10 - Reflected Cross-Site Scripting

6.1

CVE-2015-9302

Aug 25, 2015

Researchers:

WordPress Meta Robots <= 2.1 - SQL Injection

8.8

CVE-2015-9400

Aug 25, 2015

Researcher: Marcin Probola

Title	CVE ID	CVSS	Researchers	Date
WatuPRO < 4.9.0.8 - Cross-Site Request Forgery	CVE-2015-9418	4.3	Mallory Adams	September 1, 2015
CKEditor for WordPress <= 4.5.3 - Reflected Cross-Site Scripting	CVE-2015-9349	6.1	Marcin Probola	August 31, 2015
NextGen Gallery <= 2.1.9 - Cross-Site Scripting	CVE-2015-9537	6.4	Sathish Kumar	August 31, 2015
sourceAFRICA <= 0.1.3 - Cross-Site Scripting	CVE-2015-6920	6.1	Ehsan Hosseini	August 29, 2015
Responsive Thumbnail Slider < 1.0.1 - Arbitrary File Upload		8.8	Arash Khazaei	August 29, 2015
Job Manager <= 0.7.25 - Insecure Direct Object Reference	CVE-2015-6668	7.5	Evangelos Mourikis	August 28, 2015
NextGen Gallery <= 2.1.7 - Path Traversal		6.5	Sathish Kumar	August 28, 2015
Captain Slider <= 1.0.6 - Stored Cross-Site Scripting	CVE-2015-9419	6.1	Arash Khazaei	August 28, 2015
NextGen Gallery <= 2.1.10 - Local File Inclusion	CVE-2015-9538	6.5	Sathish Kumar	August 28, 2015
YouTube Embed <= 3.3.2 - Cross-Site Scripting	CVE-2015-6535	5.5		August 26, 2015
Navis DocumentCloud < 0.1.1 - Reflected Cross-Site Scripting	CVE-2015-2807	6.1	Harry Metcalfe (DXW)	August 26, 2015
Car Rental System < 3.1 - SQL Injection		9.8	Manish Kishan Tanwar	August 26, 2015
Smart Slider 2 <= 2.3.11 - Reflected Cross-Site Scripting		6.1	Marcin Probola	August 26, 2015
Role Scoper <= 1.3.64 - Reflected Cross-Site Scripting		7.1	Marcin Probola	August 26, 2015
Simple Slideshow Manager <= 2.1 - Cross-Site Request Forgery		7.3		August 26, 2015
SoundCloud Is Gold <= 2.3.1 - Reflected Cross-Site Scripting	CVE-2015-9420	6.1	Marcin Probola	August 26, 2015
Private Only <= 3.5.1 - Multiple Cross-Site Request Forgery	CVE-2015-5483	8.8	Mallory Adams, dwxsupport	August 26, 2015
GoCodes <= 1.3.5 - Authenticated Blind SQL Injection	CVE-2015-9398	8.8	Marcin Probola	August 25, 2015
Simple Fields <= 1.4.10 - Reflected Cross-Site Scripting	CVE-2015-9302	6.1		August 25, 2015
WordPress Meta Robots <= 2.1 - SQL Injection	CVE-2015-9400	8.8	Marcin Probola	August 25, 2015

Submit Vulnerability

«
‹
1
2
...
960
961
962
...
1071
1072
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Nov 21, 2024 Vulns
1	SOPROBRO	139
2	vgo0	68
3	Peter Thaleikis	66
4	Francesco Carlucci	39
5	Mika	37
6	João Pedro Soares de Alcântara	37
7	stealthcopter	23
8	theviper17y	19
9	zaim	19
10	Gab	16
11	thiennv	16
12	zakaria	15
13	ardias	15
14	Arkadiusz Hydzik	15
15	Colin Xu	13
16	mikemyers	12
17	yudha	11
18	zer0gh0st	11
19	LVT-tholv2k	11
20	Tieu Pham Trong Nhan	11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation