WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WP-DBManager < 2.72 - OS Command Injection
7.8
CVE-2014-8334
Oct 13, 2014
Researcher: Larry W. Cashdollar
Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes
7.7
CVE-2023-0631
Feb 28, 2023
Researcher: Marc-Alexandre Montpas
WP CSV Exporter <= 1.3.6 - CSV Injection
7.7
CVE-2022-3605
Nov 29, 2022
Researcher: Francesco Carlucci
Better Messages <= 1.9.10.57 - Resource Exhaustion
7.7
CVE-2022-33142
Aug 22, 2022
Researcher: Dhakal Ananda
Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure
7.7
CVE-2022-31090
Jun 20, 2022
Researchers:
Safe SVG <= 1.9.9 - Content-Type Bypass
7.7
CVE-2022-1091
Mar 25, 2022
Researcher: David Hamann
Simple Job Board <= 2.9.3 - Local File Inclusion
7.7
CVE-2020-35749
Feb 6, 2022
Researcher: Ven3xy
RVM - Responsive Vector Maps <= 6.4.1 - Subscriber+ Arbitrary File Read
7.7
CVE-2021-24947
Jan 6, 2022
Researcher: Krzysztof Zając
Import and export users and customers 1.15 - Sensitive Data Exposure
7.7
CVE ID Unknown
Jan 1, 2020
Researchers:
WordPress Core < 5.0.1 - Arbitrary File Deletion
7.7
CVE-2018-20147
Dec 12, 2018
Researcher: Karim El Ouerghemmi
WordPress Core < 4.7.5 - Server-Side Request Forgery
7.7
CVE-2017-9066
May 16, 2017
Researcher: Ronnie Skansing
WordPress Core < 4.0.1 - Server-Side Request Forgery
7.7
CVE-2014-9038
Nov 20, 2014
Researcher: Ben Bidner
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
7.6
CVE-2024-1217
Feb 19, 2024
Researcher: Lucio Sá
RumbleTalk Live Group Chat <= 6.1.9 - Missing Authorization via handleRequest
7.6
CVE-2023-45828
Oct 13, 2023
Researcher: Mika
Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection
7.6
CVE-2023-3447
Jun 28, 2023
Researchers: Luca Greeb, Andreas Krüger
Jupiter X Core <= 2.0.9 - Missing Authorization Checks
7.6
CVE ID Unknown
Aug 8, 2022
Researchers:
Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 - Missing Authorization to Stored Cross-Site Scripting
7.6
CVE-2021-42360
Oct 4, 2021
Researcher: Ram
WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting
7.6
CVE-2021-39201
Sep 9, 2021
Researcher: Michał Bentkowski
WordPress Core 5.8 beta - Stored Cross-Site Scripting in Custom HTML Block
7.6
CVE-2021-39202
Sep 9, 2021
Researcher: Evan Ricafort
Gallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivation
7.6
CVE-2019-25149
Dec 30, 2019
Researcher: Jerome Bruandet
Title CVE ID CVSS Researchers Date
WP-DBManager < 2.72 - OS Command Injection CVE-2014-8334 7.8 Larry W. Cashdollar October 13, 2014
Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes CVE-2023-0631 7.7 Marc-Alexandre Montpas February 28, 2023
WP CSV Exporter <= 1.3.6 - CSV Injection CVE-2022-3605 7.7 Francesco Carlucci November 29, 2022
Better Messages <= 1.9.10.57 - Resource Exhaustion CVE-2022-33142 7.7 Dhakal Ananda August 22, 2022
Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure CVE-2022-31090 7.7 June 20, 2022
Safe SVG <= 1.9.9 - Content-Type Bypass CVE-2022-1091 7.7 David Hamann March 25, 2022
Simple Job Board <= 2.9.3 - Local File Inclusion CVE-2020-35749 7.7 Ven3xy February 6, 2022
RVM - Responsive Vector Maps <= 6.4.1 - Subscriber+ Arbitrary File Read CVE-2021-24947 7.7 Krzysztof Zając January 6, 2022
Import and export users and customers 1.15 - Sensitive Data Exposure 7.7 January 1, 2020
WordPress Core < 5.0.1 - Arbitrary File Deletion CVE-2018-20147 7.7 Karim El Ouerghemmi December 12, 2018
WordPress Core < 4.7.5 - Server-Side Request Forgery CVE-2017-9066 7.7 Ronnie Skansing May 16, 2017
WordPress Core < 4.0.1 - Server-Side Request Forgery CVE-2014-9038 7.7 Ben Bidner November 20, 2014
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation CVE-2024-1217 7.6 Lucio Sá February 19, 2024
RumbleTalk Live Group Chat <= 6.1.9 - Missing Authorization via handleRequest CVE-2023-45828 7.6 Mika October 13, 2023
Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection CVE-2023-3447 7.6 Luca Greeb, Andreas Krüger June 28, 2023
Jupiter X Core <= 2.0.9 - Missing Authorization Checks 7.6 August 8, 2022
Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 - Missing Authorization to Stored Cross-Site Scripting CVE-2021-42360 7.6 Ram October 4, 2021
WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting CVE-2021-39201 7.6 Michał Bentkowski September 9, 2021
WordPress Core 5.8 beta - Stored Cross-Site Scripting in Custom HTML Block CVE-2021-39202 7.6 Evan Ricafort September 9, 2021
Gallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivation CVE-2019-25149 7.6 Jerome Bruandet December 30, 2019
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 5, 2024
Vulns
1 Francesco Carlucci 48
2 vgo0 47
3 wesley (wcraft) 20
4 João Pedro Soares de Alcântara 12
5 stealthcopter 12
6 Krzysztof Zając 11
7 Lucio Sá 11
8 tahu.datar 11
9 Peter Thaleikis 9
10 Le Ngoc Anh 9
11 Webbernaut 8
12 Robert DeVore 8
13 Colin Xu 6
14 TANG Cheuk Hei (siunam) 5
15 Jorge Diaz (ddiax) 5
16 SOPROBRO 5
17 Dmitrii Ignatyev 5
18 Daniel Ruf 5
19 LVT-tholv2k 5
20 Trương Hữu Phúc (truonghuuphuc) 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation