🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions

8.1

CVE-2024-8548

Sep 30, 2024

Researcher: Krzysztof Zając

Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover

8.1

CVE-2024-7781

Sep 25, 2024

Researcher: Geo Void

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read

8.1

CVE-2024-7626

Sep 10, 2024

Researcher: Connor Billings

Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

8.1

CVE-2024-7627

Sep 4, 2024

Researcher: TANG Cheuk Hei (siunam)

myCred <= 2.7.2 - Unauthenticated PHP Object Injection

8.1

CVE-2024-43354

Aug 16, 2024

Researcher: LVT-tholv2k

Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload

8.1

CVE-2023-0714

Aug 16, 2024

Researcher: Ram

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover

8.1

CVE-2024-7628

Aug 14, 2024

Researcher: Truoc Phan

Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation

8.1

CVE-2024-7624

Aug 14, 2024

Researcher: wesley (wcraft)

Crew HRM <= 1.1.1 - Unauthenticated PHP Object Injection

8.1

CVE-2024-43252

Aug 12, 2024

Researcher: CatFather

Indeed Membership Pro <= 12.6 - Unauthenticated PHP Object Injection

8.1

CVE-2024-43242

Aug 12, 2024

Researcher: Rafie Muhammad

Participants Database <= 2.5.9.2 - Unauthenticated PHP Object Injection

8.1

CVE-2024-43141

Aug 7, 2024

Researcher: LVT-tholv2k

MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVE-2024-6885

Jul 22, 2024

Researcher: Lucio Sá

JetThemeCore for Elementor <= 2.2.0 - Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVE-2024-37497

Jul 4, 2024

Researcher: Dave Jong

WishList Member X <= 3.25.1 - Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVE-2024-37108

Jun 20, 2024

Researcher: Dave Jong

8.1

CVE-2024-6125

Jun 18, 2024

Researcher: István Márton

Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure

8.1

CVE-2023-6696

Jun 14, 2024

Researcher: Lucio Sá

Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection

8.1

CVE-2024-5543

Jun 11, 2024

Researcher: Krzysztof Zając

The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions

8.1

CVE-2023-6966

Jun 5, 2024

Researcher: Francesco Carlucci

The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions

8.1

CVE-2023-6968

Jun 5, 2024

Researcher: Francesco Carlucci

AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass

8.1

CVE-2024-4611

May 28, 2024

Researcher: István Márton

Title	CVE ID	CVSS	Researchers	Date
KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions	CVE-2024-8548	8.1	Krzysztof Zając	September 30, 2024
Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover	CVE-2024-7781	8.1	Geo Void	September 25, 2024
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read	CVE-2024-7626	8.1	Connor Billings	September 10, 2024
Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition	CVE-2024-7627	8.1	TANG Cheuk Hei (siunam)	September 4, 2024
myCred <= 2.7.2 - Unauthenticated PHP Object Injection	CVE-2024-43354	8.1	LVT-tholv2k	August 16, 2024
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload	CVE-2023-0714	8.1	Ram	August 16, 2024
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover	CVE-2024-7628	8.1	Truoc Phan	August 14, 2024
Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation	CVE-2024-7624	8.1	wesley (wcraft)	August 14, 2024
Crew HRM <= 1.1.1 - Unauthenticated PHP Object Injection	CVE-2024-43252	8.1	CatFather	August 12, 2024
Indeed Membership Pro <= 12.6 - Unauthenticated PHP Object Injection	CVE-2024-43242	8.1	Rafie Muhammad	August 12, 2024
Participants Database <= 2.5.9.2 - Unauthenticated PHP Object Injection	CVE-2024-43141	8.1	LVT-tholv2k	August 7, 2024
MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion	CVE-2024-6885	8.1	Lucio Sá	July 22, 2024
JetThemeCore for Elementor <= 2.2.0 - Authenticated (Subscriber+) Arbitrary File Deletion	CVE-2024-37497	8.1	Dave Jong	July 4, 2024
WishList Member X <= 3.25.1 - Authenticated (Subscriber+) Arbitrary File Deletion	CVE-2024-37108	8.1	Dave Jong	June 20, 2024
Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism	CVE-2024-6125	8.1	István Márton	June 18, 2024
Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure	CVE-2023-6696	8.1	Lucio Sá	June 14, 2024
Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection	CVE-2024-5543	8.1	Krzysztof Zając	June 11, 2024
The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions	CVE-2023-6966	8.1	Francesco Carlucci	June 5, 2024
The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions	CVE-2023-6968	8.1	Francesco Carlucci	June 5, 2024
AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass	CVE-2024-4611	8.1	István Márton	May 28, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Sep 5, 2024 Vulns
1	Francesco Carlucci	48
2	vgo0	47
3	wesley (wcraft)	20
4	João Pedro Soares de Alcântara	12
5	stealthcopter	12
6	Krzysztof Zając	11
7	Lucio Sá	11
8	tahu.datar	11
9	Peter Thaleikis	9
10	Le Ngoc Anh	9
11	Webbernaut	8
12	Robert DeVore	8
13	Colin Xu	6
14	TANG Cheuk Hei (siunam)	5
15	Jorge Diaz (ddiax)	5
16	SOPROBRO	5
17	Dmitrii Ignatyev	5
18	Daniel Ruf	5
19	LVT-tholv2k	5
20	Trương Hữu Phúc (truonghuuphuc)	5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation