🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry

7.2

CVE-2024-2344

Mar 20, 2024

Researcher: Muhammad Zeeshan (Xib3rR4dAr)

Better Search <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-29142

Mar 18, 2024

Researcher: Abdi Pranata

Contact Forms by Cimatti <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-29117

Mar 16, 2024

Researcher: Joshua Chan

Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-29102

Mar 15, 2024

Researcher: RE-ALTER

Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url

7.2

CVE-2024-1812

Mar 15, 2024

Researcher: hir0ot

Zippy <= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload

7.2

CVE-2024-27964

Mar 13, 2024

Researcher: stealthcopter

Multiple Page Generator Plugin – MPG <= 3.4.0 - Authenticated (Editor+) Remote Code Execution

7.2

CVE-2024-27951

Mar 13, 2024

Researcher: Majed Refaea

weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer

7.2

CVE-2024-0386

Mar 12, 2024

Researcher: drop

WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-2194

Mar 11, 2024

Researcher: Tim Coen

Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-2123

Mar 8, 2024

Researcher: stealthcopter

Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-2020

Mar 1, 2024

Researcher: Asaf Mozes

Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-1935

Feb 29, 2024

Researcher: Krzysztof Zając

AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection

7.2

CVE-2024-1793

Feb 29, 2024

Researchers: Kunal Sharma, Akshay Kumar

LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'

7.2

CVE-2023-40000

Feb 27, 2024

Researcher: Rafie Muhammad

Admin side data storage for Contact Form 7 <= 1.1.1 - Authenticated (Admin+) SQL Injection

7.2

CVE-2024-1776

Feb 22, 2024

Researcher: zulu caPWN

Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload

7.2

CVE-2024-1069

Jan 30, 2024

Researcher: István Márton

coreActivity <= 1.8 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-0852

Jan 26, 2024

Researcher: Ahmed Algohary

illi Link Party! <= 1.0 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2023-7228

Jan 23, 2024

Researcher: Bob Matyas

WPForms Pro 1.8.4 - 1.8.5.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission

7.2

CVE-2023-7063

Jan 19, 2024

Researcher: drop

Smart Manager - WooCommerce Advanced Bulk Edit, Inventory Management & more... <= 8.27.0 - Authenticated (Admin+) SQL Injection

7.2

CVE-2024-0566

Jan 18, 2024

Researcher: Ivan Spiridonov (xbz0n)

Title	CVE ID	CVSS	Researchers	Date
Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry	CVE-2024-2344	7.2	Muhammad Zeeshan (Xib3rR4dAr)	March 20, 2024
Better Search <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-29142	7.2	Abdi Pranata	March 18, 2024
Contact Forms by Cimatti <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-29117	7.2	Joshua Chan	March 16, 2024
Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-29102	7.2	RE-ALTER	March 15, 2024
Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url	CVE-2024-1812	7.2	hir0ot	March 15, 2024
Zippy <= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload	CVE-2024-27964	7.2	stealthcopter	March 13, 2024
Multiple Page Generator Plugin – MPG <= 3.4.0 - Authenticated (Editor+) Remote Code Execution	CVE-2024-27951	7.2	Majed Refaea	March 13, 2024
weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer	CVE-2024-0386	7.2	drop	March 12, 2024
WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-2194	7.2	Tim Coen	March 11, 2024
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-2123	7.2	stealthcopter	March 8, 2024
Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-2020	7.2	Asaf Mozes	March 1, 2024
Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-1935	7.2	Krzysztof Zając	February 29, 2024
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection	CVE-2024-1793	7.2	Kunal Sharma, Akshay Kumar	February 29, 2024
LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'	CVE-2023-40000	7.2	Rafie Muhammad	February 27, 2024
Admin side data storage for Contact Form 7 <= 1.1.1 - Authenticated (Admin+) SQL Injection	CVE-2024-1776	7.2	zulu caPWN	February 22, 2024
Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload	CVE-2024-1069	7.2	István Márton	January 30, 2024
coreActivity <= 1.8 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-0852	7.2	Ahmed Algohary	January 26, 2024
illi Link Party! <= 1.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2023-7228	7.2	Bob Matyas	January 23, 2024
WPForms Pro 1.8.4 - 1.8.5.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission	CVE-2023-7063	7.2	drop	January 19, 2024
Smart Manager - WooCommerce Advanced Bulk Edit, Inventory Management & more... <= 8.27.0 - Authenticated (Admin+) SQL Injection	CVE-2024-0566	7.2	Ivan Spiridonov (xbz0n)	January 18, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Sep 4, 2024 Vulns
1	vgo0	48
2	Francesco Carlucci	48
3	wesley (wcraft)	21
4	João Pedro Soares de Alcântara	12
5	stealthcopter	12
6	Lucio Sá	12
7	Krzysztof Zając	11
8	tahu.datar	11
9	Peter Thaleikis	9
10	Robert DeVore	8
11	Le Ngoc Anh	8
12	Webbernaut	7
13	Trương Hữu Phúc (truonghuuphuc)	5
14	SOPROBRO	5
15	Jorge Diaz (ddiax)	5
16	theviper17y	5
17	Colin Xu	5
18	Daniel Ruf	5
19	TANG Cheuk Hei (siunam)	4
20	Dmitrii Ignatyev	4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation