WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Image Slider < 1.1.90 - Arbitrary File Deletion
8.1
CVE ID Unknown
Dec 23, 2016
Researcher: dwxsupport
Post Indexer <= 3.0.6.1 - PHP Object Injection
8.1
CVE-2016-10948
Nov 17, 2016
Researcher: Glyn Wintle
Welcart e-Commerce < 1.8.3 - Object Injection
8.1
CVE-2016-4825
Jun 24, 2016
Researcher: Gen Sato
Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection
8.1
CVE-2016-1209
May 13, 2016
Researchers:
Booking Calendar Contact Form <= 1.0.23 - Shortcode SQL Injection
8.1
CVE ID Unknown
Feb 8, 2016
Researcher: Joaquin Ramirez Martinez
WP Super Cache <= 1.4.4 - PHP Object Injection
8.1
CVE ID Unknown
Sep 25, 2015
Researchers:
WordPress Download Manager <= 2.7.2 - Authenticated Arbitrary Options Update
8.1
CVE-2014-9260
Nov 24, 2014
Researcher: Kacper Szurek
Wordpress Core < 4.0.1 - Hash Collision
8.1
CVE-2014-9037
Nov 20, 2014
Researcher: David Anderson
Contact Form by WD – responsive drag & drop contact form builder tool <= 1.7.18 - Authorization Bypass
8.1
CVE ID Unknown
Nov 9, 2014
Researcher: Kacper Szurek
Simple Share Buttons Adder <= 4.4 - Cross-Site Request Forgery
8.1
CVE ID Unknown
Jun 26, 2014
Researcher: Duncan Stuart
Eventify - Simple Events <= 1.7.f - SQL Injection via eventid
8.1
CVE ID Unknown
Sep 7, 2011
Researcher: Miroslav Stampar
WordPress Core < 2.6.2 - Arbitrary User Password Reset
8.1
CVE-2008-4106
Sep 8, 2008
Researcher: Stefan Esser
WordPress Core < 2.5.1 - Authentication Bypass
8.1
CVE-2008-1930
Apr 25, 2008
Researchers:
WPForms User Registration <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation
8.0
CVE-2023-52209
Jul 18, 2024
Researcher: Rafie Muhammad
140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection
8.0
CVE-2024-4471
May 22, 2024
Researcher: Francesco Carlucci
Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure
8.0
CVE-2023-5576
Oct 13, 2023
Researchers:
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution
8.0
CVE-2023-4141
Aug 3, 2023
Researcher: István Márton
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution
8.0
CVE-2023-4142
Aug 3, 2023
Researcher: István Márton
Export Users With Meta <= 0.6.8 - CSV Injection
8.0
CVE-2022-44577
Nov 17, 2022
Researcher: Mika
Checkout Field Editor <= 1.7.2 - Authenticated (Admin+) PHP Object Injection
8.0
CVE-2022-3490
Nov 7, 2022
Researcher: Nguyen Duy Quoc Khanh
Title CVE ID CVSS Researchers Date
Image Slider < 1.1.90 - Arbitrary File Deletion 8.1 dwxsupport December 23, 2016
Post Indexer <= 3.0.6.1 - PHP Object Injection CVE-2016-10948 8.1 Glyn Wintle November 17, 2016
Welcart e-Commerce < 1.8.3 - Object Injection CVE-2016-4825 8.1 Gen Sato June 24, 2016
Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection CVE-2016-1209 8.1 May 13, 2016
Booking Calendar Contact Form <= 1.0.23 - Shortcode SQL Injection 8.1 Joaquin Ramirez Martinez February 8, 2016
WP Super Cache <= 1.4.4 - PHP Object Injection 8.1 September 25, 2015
WordPress Download Manager <= 2.7.2 - Authenticated Arbitrary Options Update CVE-2014-9260 8.1 Kacper Szurek November 24, 2014
Wordpress Core < 4.0.1 - Hash Collision CVE-2014-9037 8.1 David Anderson November 20, 2014
Contact Form by WD – responsive drag & drop contact form builder tool <= 1.7.18 - Authorization Bypass 8.1 Kacper Szurek November 9, 2014
Simple Share Buttons Adder <= 4.4 - Cross-Site Request Forgery 8.1 Duncan Stuart June 26, 2014
Eventify - Simple Events <= 1.7.f - SQL Injection via eventid 8.1 Miroslav Stampar September 7, 2011
WordPress Core < 2.6.2 - Arbitrary User Password Reset CVE-2008-4106 8.1 Stefan Esser September 8, 2008
WordPress Core < 2.5.1 - Authentication Bypass CVE-2008-1930 8.1 April 25, 2008
WPForms User Registration <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation CVE-2023-52209 8.0 Rafie Muhammad July 18, 2024
140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection CVE-2024-4471 8.0 Francesco Carlucci May 22, 2024
Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure CVE-2023-5576 8.0 October 13, 2023
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution CVE-2023-4141 8.0 István Márton August 3, 2023
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution CVE-2023-4142 8.0 István Márton August 3, 2023
Export Users With Meta <= 0.6.8 - CSV Injection CVE-2022-44577 8.0 Mika November 17, 2022
Checkout Field Editor <= 1.7.2 - Authenticated (Admin+) PHP Object Injection CVE-2022-3490 8.0 Nguyen Duy Quoc Khanh November 7, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 5, 2024
Vulns
1 Francesco Carlucci 48
2 vgo0 47
3 wesley (wcraft) 20
4 João Pedro Soares de Alcântara 12
5 stealthcopter 12
6 Krzysztof Zając 11
7 Lucio Sá 11
8 tahu.datar 11
9 Peter Thaleikis 9
10 Le Ngoc Anh 9
11 Webbernaut 8
12 Robert DeVore 8
13 Colin Xu 6
14 TANG Cheuk Hei (siunam) 5
15 Jorge Diaz (ddiax) 5
16 SOPROBRO 5
17 Dmitrii Ignatyev 5
18 Daniel Ruf 5
19 LVT-tholv2k 5
20 Trương Hữu Phúc (truonghuuphuc) 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation