WordPress Vulnerability Database

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Title CVE ID CVSS Researchers Date
Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload CVE-2024-8480 8.8 scottaglia August 21, 2024
AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function CVE-2024-7384 7.5 Arkadiusz Hydzik August 21, 2024
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings CVE-2024-5583 6.4 Ngô Thiên An (ancorn_) August 21, 2024
Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication CVE-2024-7836 4.3 Peter Thaleikis August 21, 2024
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection CVE-2024-6386 9.9 stealthcopter August 21, 2024
User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access CVE-2024-7848 4.3 Peter Thaleikis August 21, 2024
LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation CVE-2024-28000 9.8 John Blackbourn August 21, 2024
Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection CVE-2024-5335 9.8 Peter Thaleikis August 20, 2024
Hide My Site <= 2.2 - Unauthenticated Information Exposure CVE-2024-5880 4.3 Colin Xu August 20, 2024
Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification CVE-2024-6883 4.3 Lucio Sá August 20, 2024
WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter CVE-2024-6767 5.5 Artem Polynko (Artem Polynko) August 20, 2024
Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update CVE-2024-7030 4.3 Lucio Sá August 20, 2024
Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion CVE-2024-7032 6.5 Lucio Sá August 20, 2024
LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting CVE-2024-7090 6.1 Piotr Kuśpit August 20, 2024
App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search CVE-2024-7651 5.6 vgo0 August 20, 2024
Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-7629 6.4 lowol August 20, 2024
WP Testimonial Widget <= 3.0 - Missing Authorization CVE-2024-7390 5.3 Francesco Carlucci August 20, 2024
LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter CVE-2024-7134 7.2 zer0gh0st August 20, 2024
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection CVE-2024-7854 10.0 theviper17y August 20, 2024
Starbox – the Author Box for Humans <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-7955 4.4 Krugov Artyom August 20, 2024

Researcher Hall of Fame (Past 30 days)

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation