WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Awesome Filterable Portfolio <= 1.9.7 - Missing Authorization to Plugin Settings Change
7.5
CVE-2022-35238
Sep 15, 2022
Researcher: Ngo Van Thien
BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Download
7.5
CVE-2022-31474
Sep 6, 2022
Researchers:
WP Popup Builder <= 1.2.9 - Missing Authorization and Cross-Site Request Forgery
7.5
CVE-2022-2405
Sep 5, 2022
Researcher: Krzysztof Zając
Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read
7.5
CVE-2022-41840
Sep 2, 2022
Researchers:
Accommodation System <= 1.0.1 - Missing Authorization
7.5
CVE-2022-37344
Aug 25, 2022
Researchers:
About Rentals <= 1.5 - Missing Authorization
7.5
CVE-2022-36427
Aug 25, 2022
Researcher: ptsfence
Access Code Feeder <= 1.0.3 - Missing Authorization
7.5
CVE-2022-38059
Aug 25, 2022
Researcher: ptsfence
About Me <= 1.0.12 - Missing Authorization
7.5
CVE-2022-36387
Aug 25, 2022
Researchers:
WP Hotel Booking <= 2.0.0 - Missing Authorization to Settings Update
7.5
CVE ID Unknown
Aug 22, 2022
Researcher: WPScanTeam
All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery
7.5
CVE-2022-2633
Aug 17, 2022
Researcher: Gabriele Zuddas
Directorist <= 7.3.0 - Sensitive Information Disclosure
7.5
CVE-2022-2376
Aug 10, 2022
Researcher: Krzysztof Zając
Affiliate For WooCommerce premium <= 4.7.0 - Authenticated Insecure Direct Object Reference
7.5
CVE-2022-36284
Aug 1, 2022
Researcher: RE-ALTER
Simple Job Board <= 2.9.6 - Information Disclosure
7.5
CVE-2022-2558
Aug 1, 2022
Researchers:
WP Edit Menu < 1.5.0 - Missing Authorization to Post Deletion
7.5
CVE-2022-2276
Aug 1, 2022
Researcher: Johannes Gangsö
Ninja Job Board <= 1.3.2 - Information Disclosure
7.5
CVE-2022-2544
Aug 1, 2022
Researchers:
Team - WordPress Team Member Showcase Plugin <= 4.1.1 - Directory Traversal to Arbitrary File Read/Deletion
7.5
CVE-2022-2557
Jul 29, 2022
Researcher: Nhật Nam
Duplicator – WordPress Migration Plugin <= 1.4.7 - Sensitive Information Disclosure
7.5
CVE-2022-2552
Jul 27, 2022
Researcher: SecuriTrust
guzzlehttp/psr7 <= 1.84 and 2.0.0-2.1.0 - Improper Input Validation
7.5
CVE-2022-24775
Jul 19, 2022
Researchers:
MultiSafepay plugin for WooCommerce <= 4.15.0 - Arbitrary File Read
7.5
CVE-2022-33901
Jul 18, 2022
Researcher: Brandon James Roldan (tomorrowisnew)
Ultimate Member <= 2.4.1 - Username Enumeration
7.5
CVE ID Unknown
Jul 14, 2022
Researchers:
Title CVE ID CVSS Researchers Date
Awesome Filterable Portfolio <= 1.9.7 - Missing Authorization to Plugin Settings Change CVE-2022-35238 7.5 Ngo Van Thien September 15, 2022
BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Download CVE-2022-31474 7.5 September 6, 2022
WP Popup Builder <= 1.2.9 - Missing Authorization and Cross-Site Request Forgery CVE-2022-2405 7.5 Krzysztof Zając September 5, 2022
Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read CVE-2022-41840 7.5 September 2, 2022
Accommodation System <= 1.0.1 - Missing Authorization CVE-2022-37344 7.5 August 25, 2022
About Rentals <= 1.5 - Missing Authorization CVE-2022-36427 7.5 ptsfence August 25, 2022
Access Code Feeder <= 1.0.3 - Missing Authorization CVE-2022-38059 7.5 ptsfence August 25, 2022
About Me <= 1.0.12 - Missing Authorization CVE-2022-36387 7.5 August 25, 2022
WP Hotel Booking <= 2.0.0 - Missing Authorization to Settings Update 7.5 WPScanTeam August 22, 2022
All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery CVE-2022-2633 7.5 Gabriele Zuddas August 17, 2022
Directorist <= 7.3.0 - Sensitive Information Disclosure CVE-2022-2376 7.5 Krzysztof Zając August 10, 2022
Affiliate For WooCommerce premium <= 4.7.0 - Authenticated Insecure Direct Object Reference CVE-2022-36284 7.5 RE-ALTER August 1, 2022
Simple Job Board <= 2.9.6 - Information Disclosure CVE-2022-2558 7.5 August 1, 2022
WP Edit Menu < 1.5.0 - Missing Authorization to Post Deletion CVE-2022-2276 7.5 Johannes Gangsö August 1, 2022
Ninja Job Board <= 1.3.2 - Information Disclosure CVE-2022-2544 7.5 August 1, 2022
Team - WordPress Team Member Showcase Plugin <= 4.1.1 - Directory Traversal to Arbitrary File Read/Deletion CVE-2022-2557 7.5 Nhật Nam July 29, 2022
Duplicator – WordPress Migration Plugin <= 1.4.7 - Sensitive Information Disclosure CVE-2022-2552 7.5 SecuriTrust July 27, 2022
guzzlehttp/psr7 <= 1.84 and 2.0.0-2.1.0 - Improper Input Validation CVE-2022-24775 7.5 July 19, 2022
MultiSafepay plugin for WooCommerce <= 4.15.0 - Arbitrary File Read CVE-2022-33901 7.5 Brandon James Roldan (tomorrowisnew) July 18, 2022
Ultimate Member <= 2.4.1 - Username Enumeration 7.5 July 14, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 6, 2024
Vulns
1 Francesco Carlucci 48
2 vgo0 47
3 wesley (wcraft) 16
4 João Pedro Soares de Alcântara 12
5 stealthcopter 12
6 tahu.datar 11
7 Krzysztof Zając 11
8 Lucio Sá 10
9 Peter Thaleikis 9
10 Le Ngoc Anh 9
11 Webbernaut 8
12 Robert DeVore 8
13 Colin Xu 6
14 Daniel Ruf 5
15 Dmitrii Ignatyev 5
16 Jorge Diaz (ddiax) 5
17 LVT-tholv2k 5
18 theviper17y 5
19 Trương Hữu Phúc (truonghuuphuc) 5
20 TANG Cheuk Hei (siunam) 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation