WordPress Vulnerability Database

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

7.3
CVE ID Unknown
Nov 12, 2024
Researcher: Pierre Rudloff
Title CVE ID CVSS Researchers Date
Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion CVE-2024-10853 4.3 incognito November 12, 2024
Styler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license CVE-2024-10717 6.5 Arkadiusz Hydzik November 12, 2024
AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting CVE-2024-8874 6.1 vgo0 November 12, 2024
Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scripting CVE-2024-10577 6.1 Peter Thaleikis November 12, 2024
WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-10038 6.1 paupu November 12, 2024
Constant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site Scripting CVE-2024-9614 6.1 vgo0 November 12, 2024
Aqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2024-9426 6.4 Francesco Carlucci November 12, 2024
Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting CVE-2024-10851 6.1 Peter Thaleikis November 12, 2024
Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution CVE-2024-9578 5.3 Francesco Carlucci November 12, 2024
BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure CVE-2024-10778 4.3 Francesco Carlucci November 12, 2024
Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting CVE-2024-10850 6.1 Peter Thaleikis November 12, 2024
Social Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode CVE-2024-8985 6.4 Peter Thaleikis November 12, 2024
GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation CVE-2024-10629 8.8 Francesco Carlucci November 12, 2024
NiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-10887 6.4 Peter Thaleikis November 12, 2024
Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure CVE-2024-10794 4.3 Francesco Carlucci November 12, 2024
Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget CVE-2024-9682 6.4 zer0gh0st November 12, 2024
Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update CVE-2024-10531 5.3 Tieu Pham Trong Nhan November 12, 2024
LUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Read CVE-2024-10816 7.5 Tonn November 12, 2024
Twigify <= 1.1.2 - Running Vulnerable Twig Package 7.3 Pierre Rudloff November 12, 2024
Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget CVE-2024-9059 6.4 zer0gh0st November 12, 2024

Researcher Hall of Fame (Past 30 days)

Rank Name
Vulnerabilities since Oct 24, 2024
Vulns
1 SOPROBRO 213
2 Francesco Carlucci 65
3 Peter Thaleikis 53
4 stealthcopter 51
5 Gab 43
6 João Pedro Soares de Alcântara 41
7 vgo0 41
8 LVT-tholv2k 25
9 Mika 20
10 István Márton 20
11 Tonn 17
12 Arkadiusz Hydzik 13
13 zer0gh0st 12
14 wesley (wcraft) 11
15 theviper17y 10
16 Trương Hữu Phúc (truonghuuphuc) 10
17 Tieu Pham Trong Nhan 9
18 Bonds 8
19 Joshua Chan 8
20 Ankit Patel 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation