WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
OpenInviter for WordPress <= 1.7.0 - Sensitive Information Disclosure
7.5
CVE ID Unknown
Jan 5, 2013
Researcher: Ryuzaki Lawlet
Download Shortcode <= 0.2.3 - Directory Traversal
7.5
CVE-2014-5465
Jan 3, 2013
Researchers:
Grou Random Image Widget <= 1.18 - Full Path Disclosure
7.5
CVE ID Unknown
Dec 24, 2012
Researcher: Zikou-16
WordPress RokBox <= 2.13 - Full Path Disclosure
7.5
CVE ID Unknown
Dec 17, 2012
Researcher: Eugene Dokukin
WordPress RokBox <= 2.13 - Denial of Service
7.5
CVE ID Unknown
Dec 17, 2012
Researcher: Eugene Dokukin
Cimy User Manager < 1.4.4 - Arbitrary File Read
7.5
CVE ID Unknown
Oct 24, 2012
Researcher: Charlie Eriksen
Simple Download Button Shortcode <= 1.0 - Information Disclosure via Arbitrary File Downloads
7.5
CVE-2012-10016
Sep 17, 2012
Researchers:
Vitamin < 1.1.0 - Directory Traversal
7.5
CVE-2012-6651
Aug 7, 2012
Researchers:
Thinkun Remind <= 1.1.3 - Directory Traversal
7.5
CVE ID Unknown
Jun 8, 2012
Researcher: Sammy Forgit
Plugin: Newsletter <= 1.5 - Arbitrary File Read
7.5
CVE-2012-3588
May 31, 2012
Researcher: Sammy Forgit
Zingiri Tickets <= 3.0.3 - Sensitive Information Disclosure
7.5
CVE ID Unknown
Apr 16, 2012
Researcher: MadLeeTs
Organizer <= 1.2.1 - Path Disclosure
7.5
CVE-2012-6512
Apr 14, 2012
Researcher: Eugene Dokukin
Count per Day <= 3.1 - Arbitrary File Download
7.5
CVE-2012-0896
Jan 12, 2012
Researcher: Pavel Komisarchuk (6Scan)
WordPress Core < 3.1.1 - Denial of Service
7.5
CVE-2011-4957
Apr 5, 2011
Researchers:
WP Custom Pages <= 0.5.0.1 - Path Traversal
7.5
CVE-2011-1669
Apr 3, 2011
Researcher: John Leitch
BackWPup – WordPress Backup Plugin < 1.4.1 - Directory Traversal
7.5
CVE-2011-5208
Mar 2, 2011
Researcher: Danilo Massa
WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure
7.5
CVE-2011-3818
Jan 28, 2011
Researchers:
WordPress Core < 2.8.4 - Forced Password Reset
7.5
CVE-2009-2762
Aug 12, 2009
Researchers:
Page Flip Image Gallery <= 0.2.2 - Directory Traversal
7.5
CVE-2008-5752
Dec 22, 2008
Researcher: GolD_M
WordPress Core <= 2.3.3 - Directory Traversal
7.5
CVE-2008-4769
Apr 25, 2008
Researchers:
Title CVE ID CVSS Researchers Date
OpenInviter for WordPress <= 1.7.0 - Sensitive Information Disclosure 7.5 Ryuzaki Lawlet January 5, 2013
Download Shortcode <= 0.2.3 - Directory Traversal CVE-2014-5465 7.5 January 3, 2013
Grou Random Image Widget <= 1.18 - Full Path Disclosure 7.5 Zikou-16 December 24, 2012
WordPress RokBox <= 2.13 - Full Path Disclosure 7.5 Eugene Dokukin December 17, 2012
WordPress RokBox <= 2.13 - Denial of Service 7.5 Eugene Dokukin December 17, 2012
Cimy User Manager < 1.4.4 - Arbitrary File Read 7.5 Charlie Eriksen October 24, 2012
Simple Download Button Shortcode <= 1.0 - Information Disclosure via Arbitrary File Downloads CVE-2012-10016 7.5 September 17, 2012
Vitamin < 1.1.0 - Directory Traversal CVE-2012-6651 7.5 August 7, 2012
Thinkun Remind <= 1.1.3 - Directory Traversal 7.5 Sammy Forgit June 8, 2012
Plugin: Newsletter <= 1.5 - Arbitrary File Read CVE-2012-3588 7.5 Sammy Forgit May 31, 2012
Zingiri Tickets <= 3.0.3 - Sensitive Information Disclosure 7.5 MadLeeTs April 16, 2012
Organizer <= 1.2.1 - Path Disclosure CVE-2012-6512 7.5 Eugene Dokukin April 14, 2012
Count per Day <= 3.1 - Arbitrary File Download CVE-2012-0896 7.5 Pavel Komisarchuk (6Scan) January 12, 2012
WordPress Core < 3.1.1 - Denial of Service CVE-2011-4957 7.5 April 5, 2011
WP Custom Pages <= 0.5.0.1 - Path Traversal CVE-2011-1669 7.5 John Leitch April 3, 2011
BackWPup – WordPress Backup Plugin < 1.4.1 - Directory Traversal CVE-2011-5208 7.5 Danilo Massa March 2, 2011
WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure CVE-2011-3818 7.5 January 28, 2011
WordPress Core < 2.8.4 - Forced Password Reset CVE-2009-2762 7.5 August 12, 2009
Page Flip Image Gallery <= 0.2.2 - Directory Traversal CVE-2008-5752 7.5 GolD_M December 22, 2008
WordPress Core <= 2.3.3 - Directory Traversal CVE-2008-4769 7.5 April 25, 2008
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 5, 2024
Vulns
1 Francesco Carlucci 48
2 vgo0 47
3 wesley (wcraft) 20
4 João Pedro Soares de Alcântara 12
5 stealthcopter 12
6 Krzysztof Zając 11
7 Lucio Sá 11
8 tahu.datar 11
9 Peter Thaleikis 9
10 Le Ngoc Anh 9
11 Webbernaut 8
12 Robert DeVore 8
13 Colin Xu 6
14 TANG Cheuk Hei (siunam) 5
15 Jorge Diaz (ddiax) 5
16 SOPROBRO 5
17 Dmitrii Ignatyev 5
18 Daniel Ruf 5
19 LVT-tholv2k 5
20 Trương Hữu Phúc (truonghuuphuc) 5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation