🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Fatcat Apps Analytics Cat <= 1.0.9 - Cross-Site Request Forgery

8.8

CVE-2022-27855

Mar 8, 2022

Researcher: Rasi Afeef

Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 - Missing Authorization to Sensitive Information Disclosure

8.8

CVE-2022-0770

Mar 7, 2022

Researcher: Diogo Real

Sermon Browser <= 0.45.22 - Cross-Site Request Forgery

8.8

CVE-2022-0499

Mar 1, 2022

Researcher: Krishna Harsha Kondaveeti

Appointment and Event Booking Calendar - Amelia < 1.0.47 - Arbitrary File Upload

8.8

CVE-2022-0687

Feb 23, 2022

Researcher: qerogram

Advanced Contact form 7 DB <= 1.8.6 - Authenticated Arbitrary File Deletion

8.8

CVE-2021-24905

Feb 22, 2022

Researcher: Krzysztof Zając

Event Manager and Tickets Selling for WooCommerce < 3.5.8 - SQL Injection

8.8

CVE-2022-0478

Feb 21, 2022

Researcher: castilho

Page Builder KingComposer <= 2.9.6 - Open Redirect

8.8

CVE-2022-0165

Feb 16, 2022

Researcher: Krzysztof Zając

Simple Quotation <= 1.3.2 - SQL injection

8.8

CVE-2022-22735

Feb 16, 2022

Researcher: abhishek bhoir

Easy Embed for HubSpot Forms, CTAs, Links, Files & add HubSpot to WP Search Results <= 1.1.0 - Missing Authorization to Arbitrary Options Update

8.8

CVE ID Unknown

Feb 16, 2022

Researcher: WPScanTeam

WP Visitor Statistics (Real Time Traffic) <= 5.5 - SQL Injection

8.8

CVE-2022-0410

Feb 14, 2022

Researcher: Krzysztof Zając

Email Subscribers & Newsletters <= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection

8.8

CVE-2022-0439

Feb 11, 2022

Researcher: Krzysztof Zając

WP-Matomo Integration (WP-Piwik) <= 1.0.26 - Cross-Site Request Forgery

8.8

CVE ID Unknown

Feb 7, 2022

Researcher: Jan w Oleju

Conversios.io - Google Analytics and Google Shopping plugin for WooCommerce <= 4.6.1 Authenticated SQL Injection

8.8

CVE-2021-24952

Feb 1, 2022

Researcher: ZhongFu Su

Asgaros Forum < 2.0.0 - SQL Injection

8.8

CVE-2022-0411

Jan 31, 2022

Researcher: Krzysztof Zając

WP Email Users <= 1.7.6 - SQL Injection

8.8

CVE-2021-24959

Jan 31, 2022

Researcher: Krzysztof Zając

[GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

8.8

CVE ID Unknown

Jan 27, 2022

Researcher: RE-ALTER

Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion

8.8

CVE-2022-0328

Jan 25, 2022

Researcher: Krzysztof Zając

AdSanity < 1.8.2 - Authenticated Arbitrary File Upload

8.8

CVE-2022-4949

Jan 25, 2022

Researcher: Jerome Bruandet

Classic Editor Addon < 2.6.4 - Cross-Site Request Forgery

8.8

CVE ID Unknown

Jan 24, 2022

Researcher: Jan w Oleju

WP Debugging <= 2.11.7 - Cross-Site Request Forgery

8.8

CVE ID Unknown

Jan 24, 2022

Researcher: Jan w Oleju

Title	CVE ID	CVSS	Researchers	Date
Fatcat Apps Analytics Cat <= 1.0.9 - Cross-Site Request Forgery	CVE-2022-27855	8.8	Rasi Afeef	March 8, 2022
Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 - Missing Authorization to Sensitive Information Disclosure	CVE-2022-0770	8.8	Diogo Real	March 7, 2022
Sermon Browser <= 0.45.22 - Cross-Site Request Forgery	CVE-2022-0499	8.8	Krishna Harsha Kondaveeti	March 1, 2022
Appointment and Event Booking Calendar - Amelia < 1.0.47 - Arbitrary File Upload	CVE-2022-0687	8.8	qerogram	February 23, 2022
Advanced Contact form 7 DB <= 1.8.6 - Authenticated Arbitrary File Deletion	CVE-2021-24905	8.8	Krzysztof Zając	February 22, 2022
Event Manager and Tickets Selling for WooCommerce < 3.5.8 - SQL Injection	CVE-2022-0478	8.8	castilho	February 21, 2022
Page Builder KingComposer <= 2.9.6 - Open Redirect	CVE-2022-0165	8.8	Krzysztof Zając	February 16, 2022
Simple Quotation <= 1.3.2 - SQL injection	CVE-2022-22735	8.8	abhishek bhoir	February 16, 2022
Easy Embed for HubSpot Forms, CTAs, Links, Files & add HubSpot to WP Search Results <= 1.1.0 - Missing Authorization to Arbitrary Options Update		8.8	WPScanTeam	February 16, 2022
WP Visitor Statistics (Real Time Traffic) <= 5.5 - SQL Injection	CVE-2022-0410	8.8	Krzysztof Zając	February 14, 2022
Email Subscribers & Newsletters <= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection	CVE-2022-0439	8.8	Krzysztof Zając	February 11, 2022
WP-Matomo Integration (WP-Piwik) <= 1.0.26 - Cross-Site Request Forgery		8.8	Jan w Oleju	February 7, 2022
Conversios.io - Google Analytics and Google Shopping plugin for WooCommerce <= 4.6.1 Authenticated SQL Injection	CVE-2021-24952	8.8	ZhongFu Su	February 1, 2022
Asgaros Forum < 2.0.0 - SQL Injection	CVE-2022-0411	8.8	Krzysztof Zając	January 31, 2022
WP Email Users <= 1.7.6 - SQL Injection	CVE-2021-24959	8.8	Krzysztof Zając	January 31, 2022
[GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting		8.8	RE-ALTER	January 27, 2022
Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion	CVE-2022-0328	8.8	Krzysztof Zając	January 25, 2022
AdSanity < 1.8.2 - Authenticated Arbitrary File Upload	CVE-2022-4949	8.8	Jerome Bruandet	January 25, 2022
Classic Editor Addon < 2.6.4 - Cross-Site Request Forgery		8.8	Jan w Oleju	January 24, 2022
WP Debugging <= 2.11.7 - Cross-Site Request Forgery		8.8	Jan w Oleju	January 24, 2022

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 31, 2024 Vulns
1	Francesco Carlucci	39
2	vgo0	30
3	wesley (wcraft)	22
4	Lucio Sá	13
5	Krzysztof Zając	12
6	stealthcopter	11
7	Peter Thaleikis	10
8	Marco Wotschka	7
9	Webbernaut	7
10	TANG Cheuk Hei (siunam)	5
11	Daniel Ruf	5
12	zer0gh0st	4
13	Robert DeVore	3
14	LVT-tholv2k	3
15	Le Ngoc Anh	3
16	István Márton	3
17	rezaduty	3
18	João Pedro Soares de Alcântara	2
19	theviper17y	2
20	Tonn	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation