🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Better Messages <= 1.9.10.68 - Server-Side Request Forgery

7.4

CVE-2022-41609

Oct 21, 2022

Researcher: Dhakal Ananda

Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery

7.4

CVE-2022-3247

Oct 3, 2022

Researcher: Saggre

Craw Data <= 1.0.0 - Server Side Request Forgery

7.4

CVE-2022-2912

Aug 19, 2022

Researcher: Dhanesh Sivasamy

Web To Print Shop : uDraw <= 3.3.3 - Unauthenticated Arbitrary File Access

7.4

CVE-2022-0656

Apr 13, 2022

Researcher: cydave

Add Subtitle <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

7.4

CVE-2021-24897

Jan 26, 2022

Researcher: Francesco Carlucci

WordPress Core < 5.8.3 - SQL Injection via WP_Meta_Query

7.4

CVE-2022-21664

Jan 6, 2022

Researcher: Ben Bidner

TextMe SMS <= 1.8.8 - Authenticated Stored Cross-Site Scripting

7.4

CVE ID Unknown

Aug 24, 2021

Researchers:

WP Page Builder <= 1.2.3 - Multiple Stored Cross-Site scripting

7.4

CVE-2021-24208

Apr 8, 2021

Researcher: Ram

Facebook Chat Plugin <= 1.5 - Missing Capabilities Check

7.4

CVE ID Unknown

Aug 4, 2020

Researcher: Chloe Chamberland

Brizy < 1.0.126 - Authorization Bypass to Settings Updates

7.4

CVE-2020-36714

Jun 3, 2020

Researcher: Jerome Bruandet

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting

7.4

CVE-2020-35947

May 28, 2020

Researcher: Chloe Chamberland

7.4

CVE-2020-36715

May 14, 2020

Researcher: Jerome Bruandet

Widget Settings Importer/Exporter Plugin <= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting

7.4

CVE-2020-36769

Apr 15, 2020

Researcher: Ram

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

7.4

CVE-2020-11515

Mar 25, 2020

Researcher: Ram

Export Users to CSV < 1.4 - CSV Injection

7.4

CVE-2020-9466

Sep 19, 2019

Researcher: Jinson Varghese Behanan

Duplicate Page <= 3.3 - SQL Injection

7.4

CVE ID Unknown

Mar 22, 2019

Researcher: Marc-Alexandre Montpas

Blog2Social: Social Media Auto Post & Scheduler < 5.0.1 - PHP Object Injection

7.4

CVE ID Unknown

Sep 21, 2018

Researcher: Plugin Vulnerabilities

WP Fastest Cache <= 0.8.7.4 - SQL Injection

7.4

CVE ID Unknown

Feb 22, 2018

Researcher: RIPS Technologies

7.4

CVE ID Unknown

Dec 13, 2017

Researcher: DefenceCode

Smoke Signal < 1.2.7 - Authenticated Stored Cross-Site Scripting

7.4

CVE ID Unknown

Sep 2, 2017

Researcher: Paul Dannewitz

Title	CVE ID	CVSS	Researchers	Date
Better Messages <= 1.9.10.68 - Server-Side Request Forgery	CVE-2022-41609	7.4	Dhakal Ananda	October 21, 2022
Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery	CVE-2022-3247	7.4	Saggre	October 3, 2022
Craw Data <= 1.0.0 - Server Side Request Forgery	CVE-2022-2912	7.4	Dhanesh Sivasamy	August 19, 2022
Web To Print Shop : uDraw <= 3.3.3 - Unauthenticated Arbitrary File Access	CVE-2022-0656	7.4	cydave	April 13, 2022
Add Subtitle <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2021-24897	7.4	Francesco Carlucci	January 26, 2022
WordPress Core < 5.8.3 - SQL Injection via WP_Meta_Query	CVE-2022-21664	7.4	Ben Bidner	January 6, 2022
TextMe SMS <= 1.8.8 - Authenticated Stored Cross-Site Scripting		7.4		August 24, 2021
WP Page Builder <= 1.2.3 - Multiple Stored Cross-Site scripting	CVE-2021-24208	7.4	Ram	April 8, 2021
Facebook Chat Plugin <= 1.5 - Missing Capabilities Check		7.4	Chloe Chamberland	August 4, 2020
Brizy < 1.0.126 - Authorization Bypass to Settings Updates	CVE-2020-36714	7.4	Jerome Bruandet	June 3, 2020
Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting	CVE-2020-35947	7.4	Chloe Chamberland	May 28, 2020
Login/Signup Popup < 1.5 - Missing Authorization	CVE-2020-36715	7.4	Jerome Bruandet	May 14, 2020
Widget Settings Importer/Exporter Plugin <= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting	CVE-2020-36769	7.4	Ram	April 15, 2020
Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint	CVE-2020-11515	7.4	Ram	March 25, 2020
Export Users to CSV < 1.4 - CSV Injection	CVE-2020-9466	7.4	Jinson Varghese Behanan	September 19, 2019
Duplicate Page <= 3.3 - SQL Injection		7.4	Marc-Alexandre Montpas	March 22, 2019
Blog2Social: Social Media Auto Post & Scheduler < 5.0.1 - PHP Object Injection		7.4	Plugin Vulnerabilities	September 21, 2018
WP Fastest Cache <= 0.8.7.4 - SQL Injection		7.4	RIPS Technologies	February 22, 2018
Top 10 – Popular posts plugin for WordPress <= 2.4.3 - SQL Injection		7.4	DefenceCode	December 13, 2017
Smoke Signal < 1.2.7 - Authenticated Stored Cross-Site Scripting		7.4	Paul Dannewitz	September 2, 2017

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Sep 5, 2024 Vulns
1	Francesco Carlucci	48
2	vgo0	47
3	wesley (wcraft)	20
4	João Pedro Soares de Alcântara	12
5	stealthcopter	12
6	Krzysztof Zając	11
7	Lucio Sá	11
8	tahu.datar	11
9	Peter Thaleikis	9
10	Le Ngoc Anh	9
11	Webbernaut	8
12	Robert DeVore	8
13	Colin Xu	6
14	TANG Cheuk Hei (siunam)	5
15	Jorge Diaz (ddiax)	5
16	SOPROBRO	5
17	Dmitrii Ignatyev	5
18	Daniel Ruf	5
19	LVT-tholv2k	5
20	Trương Hữu Phúc (truonghuuphuc)	5

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation