WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
CTHthemes CityBook < 2.3.4, TownHub < 1.0.6, EasyBook < 1.2.2 Themes - Authenticated Post Deleition via IDOR
7.5
CVE-2019-20209
Dec 27, 2019
Researcher: RE-ALTER
Media Library Assistant <= 2.81 - Local File Inclusion
7.5
CVE-2020-11732
Dec 15, 2019
Researchers:
WP Intercom Slack <= 1.2.1 - Sensitive Information Disclosure
7.5
CVE-2019-14365
Nov 12, 2019
Researcher: fs0c131y
IgniteUp – Coming Soon and Maintenance Mode <= 3.4 - Unauthenticated Arbitrary File Deletion
7.5
CVE-2019-17234
Nov 10, 2019
Researcher: Jerome Bruandet
Sliced Invoices < 3.8.4 - Authenticated SQL Injection
7.5
CVE-2020-20625
Oct 17, 2019
Researcher: Jerome Bruandet
Popup-Maker <= 1.8.12 - Unauthenticated information disclosure
7.5
CVE-2019-17574
Oct 14, 2019
Researcher: Dimopoulos Elias
ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion
7.5
CVE-2019-16902
Oct 11, 2019
Researcher: AHMAD ALMORABEA
GiveWP <= 2.5.4 - Authorization Bypass
7.5
CVE-2019-20360
Sep 26, 2019
Researchers: Chloe Chamberland, Matt Barry
Search Exclude <= 1.2.3 - Arbitrary Settings Change
7.5
CVE-2019-15895
Sep 7, 2019
Researcher: Jerome Bruandet
WP Private Content Plus <= 1.31 - Unauthenticated Settings Change
7.5
CVE-2019-15816
Aug 27, 2019
Researcher: Jerome Bruandet
Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update
7.5
CVE-2019-15821
Aug 23, 2019
Researcher: Jerome Bruandet
Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks
7.5
CVE-2015-9331
Aug 20, 2019
Researchers: James Golovich, Ibrahim Raafat
Woody Ad Snippets <= 2.2.5 - Arbitrary Post Deletion
7.5
CVE-2019-14773
Aug 9, 2019
Researchers:
Adaptive Images for WordPress <= 0.6.66 - Local File Inclusion
7.5
CVE-2019-14205
Jul 19, 2019
Researcher: Mark Gruffer
Adaptive Images for WordPress <= 0.6.66 - Arbitrary File Deletion
7.5
CVE-2019-14206
Jul 19, 2019
Researcher: Mark Gruffer
Ad Inserter <= 2.4.19 - Authenticated Path Traversal
7.5
CVE-2019-15323
Jul 12, 2019
Researcher: Wilfried Becard
Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection
7.5
CVE-2019-16250
Jul 3, 2019
Researcher: Jerome Bruandet
Import and export users and customers <= 1.14.2.1 - Directory Traversal
7.5
CVE-2019-15326
Jun 20, 2019
Researchers:
ConvertPlus <= 3.4.4 - Unauthorized Account Creation
7.5
CVE-2019-15863
Jun 7, 2019
Researchers:
Simple File List <= 3.2.7 - Arbitrary File Download
7.5
CVE-2022-1119
May 23, 2019
Researchers: Admavidhya N, Bernardo Rodrigues
Title CVE ID CVSS Researchers Date
CTHthemes CityBook < 2.3.4, TownHub < 1.0.6, EasyBook < 1.2.2 Themes - Authenticated Post Deleition via IDOR CVE-2019-20209 7.5 RE-ALTER December 27, 2019
Media Library Assistant <= 2.81 - Local File Inclusion CVE-2020-11732 7.5 December 15, 2019
WP Intercom Slack <= 1.2.1 - Sensitive Information Disclosure CVE-2019-14365 7.5 fs0c131y November 12, 2019
IgniteUp – Coming Soon and Maintenance Mode <= 3.4 - Unauthenticated Arbitrary File Deletion CVE-2019-17234 7.5 Jerome Bruandet November 10, 2019
Sliced Invoices < 3.8.4 - Authenticated SQL Injection CVE-2020-20625 7.5 Jerome Bruandet October 17, 2019
Popup-Maker <= 1.8.12 - Unauthenticated information disclosure CVE-2019-17574 7.5 Dimopoulos Elias October 14, 2019
ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion CVE-2019-16902 7.5 AHMAD ALMORABEA October 11, 2019
GiveWP <= 2.5.4 - Authorization Bypass CVE-2019-20360 7.5 Chloe Chamberland, Matt Barry September 26, 2019
Search Exclude <= 1.2.3 - Arbitrary Settings Change CVE-2019-15895 7.5 Jerome Bruandet September 7, 2019
WP Private Content Plus <= 1.31 - Unauthenticated Settings Change CVE-2019-15816 7.5 Jerome Bruandet August 27, 2019
Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update CVE-2019-15821 7.5 Jerome Bruandet August 23, 2019
Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks CVE-2015-9331 7.5 James Golovich, Ibrahim Raafat August 20, 2019
Woody Ad Snippets <= 2.2.5 - Arbitrary Post Deletion CVE-2019-14773 7.5 August 9, 2019
Adaptive Images for WordPress <= 0.6.66 - Local File Inclusion CVE-2019-14205 7.5 Mark Gruffer July 19, 2019
Adaptive Images for WordPress <= 0.6.66 - Arbitrary File Deletion CVE-2019-14206 7.5 Mark Gruffer July 19, 2019
Ad Inserter <= 2.4.19 - Authenticated Path Traversal CVE-2019-15323 7.5 Wilfried Becard July 12, 2019
Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection CVE-2019-16250 7.5 Jerome Bruandet July 3, 2019
Import and export users and customers <= 1.14.2.1 - Directory Traversal CVE-2019-15326 7.5 June 20, 2019
ConvertPlus <= 3.4.4 - Unauthorized Account Creation CVE-2019-15863 7.5 June 7, 2019
Simple File List <= 3.2.7 - Arbitrary File Download CVE-2022-1119 7.5 Admavidhya N, Bernardo Rodrigues May 23, 2019
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 6, 2024
Vulns
1 Francesco Carlucci 48
2 vgo0 47
3 wesley (wcraft) 16
4 João Pedro Soares de Alcântara 12
5 stealthcopter 12
6 tahu.datar 11
7 Krzysztof Zając 11
8 Lucio Sá 10
9 Peter Thaleikis 9
10 Le Ngoc Anh 9
11 Webbernaut 8
12 Robert DeVore 8
13 Colin Xu 6
14 Daniel Ruf 5
15 Dmitrii Ignatyev 5
16 Jorge Diaz (ddiax) 5
17 LVT-tholv2k 5
18 theviper17y 5
19 Trương Hữu Phúc (truonghuuphuc) 5
20 TANG Cheuk Hei (siunam) 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation