🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Icegram Email Subscribers & Newsletters Plugin for WordPress <= 4.5.0 - Cross-Site Request Forgery

8.8

CVE-2020-5767

Jul 13, 2020

Researcher: Tenable

Responsive Menu <= 3.1.3 - Cross-Site Request Forgery

8.8

CVE-2017-18513

Jul 12, 2020

Researchers:

Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization

8.8

CVE-2020-36698

Jul 6, 2020

Researcher: Jerome Bruandet

Clean Login <= 1.10.3 - Cross-Site Request Forgery

8.8

CVE-2017-8875

Jun 29, 2020

Researcher: Zeng Wester

Advanced Forms for ACF <= 1.6.8 - Insecure Direct Object Reference

8.8

CVE-2021-24892

Jun 27, 2020

Researcher: Suppawit Punhakit

All in One Support Button + Callback Request <= 1.8.7 - Cross-Site Request Forgery

8.8

CVE ID Unknown

Jun 16, 2020

Researchers:

Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload

8.8

CVE-2020-36701

Jun 15, 2020

Researcher: Jerome Bruandet

Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control

8.8

CVE-2020-36700

Jun 15, 2020

Researcher: Jerome Bruandet

Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection

8.8

CVE-2021-24137

May 29, 2020

Researcher: Nguyen Anh Tien

MapPress Maps <= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls

8.8

CVE-2020-12675

May 28, 2020

Researcher: Alert Logic

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

8.8

CVE-2020-35944

May 28, 2020

Researcher: Chloe Chamberland

WP Frontend Profile <= 1.2.1 - Cross-Site Request Forgery

8.8

CVE ID Unknown

May 19, 2020

Researcher: Julio Potier

Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

8.8

CVE-2020-13643

May 11, 2020

Researcher: Chloe Chamberland

Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

8.8

CVE-2020-13642

May 5, 2020

Researcher: Chloe Chamberland

WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification

8.8

CVE ID Unknown

May 5, 2020

Researcher: Slavco Mihajloski

wpForo Forum <= 1.6.5 - Cross-Site Request Forgery

8.8

CVE-2019-19109

May 4, 2020

Researcher: Sh0ckFR

WordPress WP-Advanced-Search <= 3.3.6 - SQL Injection

8.8

CVE-2020-12104

Apr 28, 2020

Researchers: Hashim Alshareef, Nawaf Alkeraithe, Hashim Alshareef

Real-Time Find and Replace <= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting

8.8

CVE-2020-13641

Apr 27, 2020

Researcher: Chloe Chamberland

Duplicate Page Plugins <= (Various Versions) - SQL Injection

8.8

CVE ID Unknown

Apr 25, 2020

Researcher: Antony Garand

8.8

CVE-2020-5391

Apr 1, 2020

Researcher: Muhamad Visat

Title	CVE ID	CVSS	Researchers	Date
Icegram Email Subscribers & Newsletters Plugin for WordPress <= 4.5.0 - Cross-Site Request Forgery	CVE-2020-5767	8.8	Tenable	July 13, 2020
Responsive Menu <= 3.1.3 - Cross-Site Request Forgery	CVE-2017-18513	8.8		July 12, 2020
Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization	CVE-2020-36698	8.8	Jerome Bruandet	July 6, 2020
Clean Login <= 1.10.3 - Cross-Site Request Forgery	CVE-2017-8875	8.8	Zeng Wester	June 29, 2020
Advanced Forms for ACF <= 1.6.8 - Insecure Direct Object Reference	CVE-2021-24892	8.8	Suppawit Punhakit	June 27, 2020
All in One Support Button + Callback Request <= 1.8.7 - Cross-Site Request Forgery		8.8		June 16, 2020
Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload	CVE-2020-36701	8.8	Jerome Bruandet	June 15, 2020
Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control	CVE-2020-36700	8.8	Jerome Bruandet	June 15, 2020
Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection	CVE-2021-24137	8.8	Nguyen Anh Tien	May 29, 2020
MapPress Maps <= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls	CVE-2020-12675	8.8	Alert Logic	May 28, 2020
Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting	CVE-2020-35944	8.8	Chloe Chamberland	May 28, 2020
WP Frontend Profile <= 1.2.1 - Cross-Site Request Forgery		8.8	Julio Potier	May 19, 2020
Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting	CVE-2020-13643	8.8	Chloe Chamberland	May 11, 2020
Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting	CVE-2020-13642	8.8	Chloe Chamberland	May 5, 2020
WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification		8.8	Slavco Mihajloski	May 5, 2020
wpForo Forum <= 1.6.5 - Cross-Site Request Forgery	CVE-2019-19109	8.8	Sh0ckFR	May 4, 2020
WordPress WP-Advanced-Search <= 3.3.6 - SQL Injection	CVE-2020-12104	8.8	Hashim Alshareef, Nawaf Alkeraithe, Hashim Alshareef	April 28, 2020
Real-Time Find and Replace <= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting	CVE-2020-13641	8.8	Chloe Chamberland	April 27, 2020
Duplicate Page Plugins <= (Various Versions) - SQL Injection		8.8	Antony Garand	April 25, 2020
Login by Auth0 <= 3.11.3 - Cross-Site Request Forgery	CVE-2020-5391	8.8	Muhamad Visat	April 1, 2020

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Sep 2, 2024 Vulns
1	Francesco Carlucci	46
2	vgo0	40
3	wesley (wcraft)	22
4	Lucio Sá	14
5	Krzysztof Zając	12
6	stealthcopter	11
7	Peter Thaleikis	11
8	Marco Wotschka	7
9	Webbernaut	7
10	TANG Cheuk Hei (siunam)	5
11	Daniel Ruf	5
12	zer0gh0st	4
13	Tonn	4
14	Colin Xu	4
15	Robert DeVore	4
16	LVT-tholv2k	3
17	Le Ngoc Anh	3
18	István Márton	3
19	rezaduty	3
20	theviper17y	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation