🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion

8.2

CVE-2024-1170

Mar 6, 2024

Researcher: Lucio Sá

Watermark RELOADED <= 1.3.5 - Cross-Site Request Forgery via optionsPage

8.2

CVE-2024-27195

Feb 26, 2024

Researcher: Dimas Maulana

Fontific | Google Fonts <= 0.1.6 - Cross-Site Request Forgery via ajax_fontific_save_all

8.2

CVE-2024-27194

Feb 26, 2024

Researcher: Dimas Maulana

Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage

8.2

CVE-2024-1072

Jan 31, 2024

Researcher: Lucio Sá

Custom Dashboard Widgets <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets

8.2

CVE-2024-22290

Jan 16, 2024

Researcher: Dimas Maulana

User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

8.2

CVE-2024-0324

Jan 16, 2024

Researcher: kodaichodai

CommentLuv <= 3.0.4 - Server Side Request Forgery via do_click

8.2

CVE-2023-49159

Nov 28, 2023

Researcher: Yuchen Ji

Thumbnail Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting

8.2

CVE ID Unknown

Apr 25, 2023

Researchers:

WordPress Email Marketing Plugin – WP Email Capture <= 3.10 - Missing Authorization to Email Capture List Download

8.2

CVE-2023-28421

Mar 14, 2023

Researcher: Nguyen Anh Tien

ContentStudio <= 1.2.5 - Authorization Bypass

8.2

CVE-2023-0558

Jan 27, 2023

Researcher: Chloe Chamberland

Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Local File Inclusion

8.2

CVE ID Unknown

Aug 15, 2022

Researcher: WPScanTeam

OptinMonster <= 2.6.4 - Unprotected REST-API Endpoints

8.2

CVE-2021-39341

Nov 1, 2021

Researcher: Chloe Chamberland

SP Rental Manager <= 1.5.3 - Unauthenticated SQL Injection

8.2

CVE-2021-38324

Sep 8, 2021

Researcher: p7e4

Site Offline Or Coming Soon Or Maintenance Mode <= 1.4.2 - Cross-Site Request Forgery and Cross-Site Scripting

8.2

CVE-2020-35773

Dec 23, 2020

Researcher: Yaniv Nizry

Quiz and Survey Master <= 7.0.0 - Unauthenticated Arbitrary File Deletion

8.2

CVE-2020-35951

Aug 3, 2020

Researcher: Chloe Chamberland

Donations < 1.4 - Unauthenticated Arbitrary Options Change

8.2

CVE-2019-15772

Aug 3, 2019

Researcher: Jerome Bruandet

File Download <= 1.4 - Open Proxy

8.2

CVE-2015-1000002

Mar 27, 2017

Researcher: Larry W. Cashdollar

WordPress File Upload < 2.7.1 - Arbitrary File Upload

8.2

CVE-2015-9339

May 9, 2015

Researchers:

Slimstat Analytics < 3.9.6 - Unauthenticated Blind SQL Injection

8.2

CVE ID Unknown

Feb 24, 2015

Researcher: Marc-Alexandre Montpas

Duplicator < 0.5.10 - Arbitrary Backup Creation and Download

8.2

CVE-2014-9262

Feb 19, 2015

Researcher: Kacper Szurek

Title	CVE ID	CVSS	Researchers	Date
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion	CVE-2024-1170	8.2	Lucio Sá	March 6, 2024
Watermark RELOADED <= 1.3.5 - Cross-Site Request Forgery via optionsPage	CVE-2024-27195	8.2	Dimas Maulana	February 26, 2024
Fontific \| Google Fonts <= 0.1.6 - Cross-Site Request Forgery via ajax_fontific_save_all	CVE-2024-27194	8.2	Dimas Maulana	February 26, 2024
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage	CVE-2024-1072	8.2	Lucio Sá	January 31, 2024
Custom Dashboard Widgets <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets	CVE-2024-22290	8.2	Dimas Maulana	January 16, 2024
User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update	CVE-2024-0324	8.2	kodaichodai	January 16, 2024
CommentLuv <= 3.0.4 - Server Side Request Forgery via do_click	CVE-2023-49159	8.2	Yuchen Ji	November 28, 2023
Thumbnail Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting		8.2		April 25, 2023
WordPress Email Marketing Plugin – WP Email Capture <= 3.10 - Missing Authorization to Email Capture List Download	CVE-2023-28421	8.2	Nguyen Anh Tien	March 14, 2023
ContentStudio <= 1.2.5 - Authorization Bypass	CVE-2023-0558	8.2	Chloe Chamberland	January 27, 2023
Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Local File Inclusion		8.2	WPScanTeam	August 15, 2022
OptinMonster <= 2.6.4 - Unprotected REST-API Endpoints	CVE-2021-39341	8.2	Chloe Chamberland	November 1, 2021
SP Rental Manager <= 1.5.3 - Unauthenticated SQL Injection	CVE-2021-38324	8.2	p7e4	September 8, 2021
Site Offline Or Coming Soon Or Maintenance Mode <= 1.4.2 - Cross-Site Request Forgery and Cross-Site Scripting	CVE-2020-35773	8.2	Yaniv Nizry	December 23, 2020
Quiz and Survey Master <= 7.0.0 - Unauthenticated Arbitrary File Deletion	CVE-2020-35951	8.2	Chloe Chamberland	August 3, 2020
Donations < 1.4 - Unauthenticated Arbitrary Options Change	CVE-2019-15772	8.2	Jerome Bruandet	August 3, 2019
File Download <= 1.4 - Open Proxy	CVE-2015-1000002	8.2	Larry W. Cashdollar	March 27, 2017
WordPress File Upload < 2.7.1 - Arbitrary File Upload	CVE-2015-9339	8.2		May 9, 2015
Slimstat Analytics < 3.9.6 - Unauthenticated Blind SQL Injection		8.2	Marc-Alexandre Montpas	February 24, 2015
Duplicator < 0.5.10 - Arbitrary Backup Creation and Download	CVE-2014-9262	8.2	Kacper Szurek	February 19, 2015

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Sep 5, 2024 Vulns
1	Francesco Carlucci	48
2	vgo0	47
3	wesley (wcraft)	20
4	João Pedro Soares de Alcântara	12
5	stealthcopter	12
6	Krzysztof Zając	11
7	Lucio Sá	11
8	tahu.datar	11
9	Peter Thaleikis	9
10	Le Ngoc Anh	9
11	Webbernaut	8
12	Robert DeVore	8
13	Colin Xu	6
14	TANG Cheuk Hei (siunam)	5
15	Jorge Diaz (ddiax)	5
16	SOPROBRO	5
17	Dmitrii Ignatyev	5
18	Daniel Ruf	5
19	LVT-tholv2k	5
20	Trương Hữu Phúc (truonghuuphuc)	5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation