WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Quiz And Survey Master <= 7.3.4 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2021-36898
Oct 21, 2022
Researcher: RE-ALTER
Contact Form Entries <= 1.2.9 - CSV Injection
7.2
CVE-2022-3604
Oct 21, 2022
Researcher: Francesco Carlucci
Quiz And Survey Master <= 7.3.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2022-40698
Oct 21, 2022
Researcher: Thura Moe Myint (mgthuramoemyint)
WPForms Pro <= 1.7.6 - CSV Injection
7.2
CVE-2022-3574
Oct 19, 2022
Researcher: Francesco Carlucci
WordPress Core < 6.0.3 - Stored Cross-Site Scripting via wp-mail.php
7.2
CVE-2022-43504
Oct 18, 2022
Researcher: Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT
Chat Bubble <= 2.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2022-3415
Oct 18, 2022
Researcher: Juampa Rodríguez
Smart Slider 3 <= 3.5.1.9 - PHP Object Injection
7.2
CVE-2022-3357
Oct 10, 2022
Researcher: Nguyen Duy Quoc Khanh
Easy WP SMTP <= 1.4.9 - Authenticated (Administrator+) PHP Object Injection
7.2
CVE-2022-3334
Oct 10, 2022
Researcher: Nguyen Duy Quoc Khanh
PublishPress Capabilities <= 2.5.1 - Authenticated (Administrator+) PHP Object Injection
7.2
CVE-2022-3366
Oct 10, 2022
Researcher: Nguyen Pham Viet Nam
Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection
7.2
CVE-2022-3374
Oct 10, 2022
Researcher: Nguyen Duy Quoc Khanh
Customizer Export/Import <= 0.9.4 - Authenticated (Administrator+) PHP Object Injection
7.2
CVE-2022-3380
Oct 10, 2022
Researcher: Nguyen Duy Quoc Khanh
AntiSpam by CleanTalk <= 5.185 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3302
Oct 3, 2022
Researcher: Nguyen Duy Quoc Khanh
Kadence WooCommerce Email Designer <= 1.5.6 - PHP Object Injection
7.2
CVE-2022-3335
Sep 30, 2022
Researcher: Nguyen Duy Quoc Khanh
Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3300
Sep 29, 2022
Researcher: Nguyen Duy Quoc Khanh
Tabs <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
7.2
CVE-2022-40215
Sep 22, 2022
Researcher: RE-ALTER
WP Custom Cursors <= 3.0.1 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3150
Sep 21, 2022
Researchers: István Márton, Chien Vuong
Search Logger <= 0.9 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3131
Sep 20, 2022
Researcher: Mika
WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3243
Sep 20, 2022
Researcher: Sanjay Das Payatu
Awesome Filterable Portfolio <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2022-40193
Sep 15, 2022
Researcher: Ngo Van Thien
Awesome Support <= 6.0.7 - Authenticated Stored Cross-Site Scripting
7.2
CVE-2022-38073
Sep 14, 2022
Researcher: RE-ALTER
Title CVE ID CVSS Researchers Date
Quiz And Survey Master <= 7.3.4 - Authenticated (Administrator+) SQL Injection CVE-2021-36898 7.2 RE-ALTER October 21, 2022
Contact Form Entries <= 1.2.9 - CSV Injection CVE-2022-3604 7.2 Francesco Carlucci October 21, 2022
Quiz And Survey Master <= 7.3.10 - Unauthenticated Stored Cross-Site Scripting CVE-2022-40698 7.2 Thura Moe Myint (mgthuramoemyint) October 21, 2022
WPForms Pro <= 1.7.6 - CSV Injection CVE-2022-3574 7.2 Francesco Carlucci October 19, 2022
WordPress Core < 6.0.3 - Stored Cross-Site Scripting via wp-mail.php CVE-2022-43504 7.2 Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT October 18, 2022
Chat Bubble <= 2.2 - Unauthenticated Stored Cross-Site Scripting CVE-2022-3415 7.2 Juampa Rodríguez October 18, 2022
Smart Slider 3 <= 3.5.1.9 - PHP Object Injection CVE-2022-3357 7.2 Nguyen Duy Quoc Khanh October 10, 2022
Easy WP SMTP <= 1.4.9 - Authenticated (Administrator+) PHP Object Injection CVE-2022-3334 7.2 Nguyen Duy Quoc Khanh October 10, 2022
PublishPress Capabilities <= 2.5.1 - Authenticated (Administrator+) PHP Object Injection CVE-2022-3366 7.2 Nguyen Pham Viet Nam October 10, 2022
Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection CVE-2022-3374 7.2 Nguyen Duy Quoc Khanh October 10, 2022
Customizer Export/Import <= 0.9.4 - Authenticated (Administrator+) PHP Object Injection CVE-2022-3380 7.2 Nguyen Duy Quoc Khanh October 10, 2022
AntiSpam by CleanTalk <= 5.185 - Authenticated (Administrator+) SQL Injection CVE-2022-3302 7.2 Nguyen Duy Quoc Khanh October 3, 2022
Kadence WooCommerce Email Designer <= 1.5.6 - PHP Object Injection CVE-2022-3335 7.2 Nguyen Duy Quoc Khanh September 30, 2022
Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection CVE-2022-3300 7.2 Nguyen Duy Quoc Khanh September 29, 2022
Tabs <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2022-40215 7.2 RE-ALTER September 22, 2022
WP Custom Cursors <= 3.0.1 - Authenticated (Administrator+) SQL Injection CVE-2022-3150 7.2 István Márton, Chien Vuong September 21, 2022
Search Logger <= 0.9 - Authenticated (Administrator+) SQL Injection CVE-2022-3131 7.2 Mika September 20, 2022
WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection CVE-2022-3243 7.2 Sanjay Das Payatu September 20, 2022
Awesome Filterable Portfolio <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting CVE-2022-40193 7.2 Ngo Van Thien September 15, 2022
Awesome Support <= 6.0.7 - Authenticated Stored Cross-Site Scripting CVE-2022-38073 7.2 RE-ALTER September 14, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 2, 2024
Vulns
1 Francesco Carlucci 46
2 vgo0 40
3 wesley (wcraft) 22
4 Lucio Sá 14
5 stealthcopter 13
6 Krzysztof Zając 12
7 tahu.datar 11
8 Peter Thaleikis 11
9 João Pedro Soares de Alcântara 9
10 Marco Wotschka 7
11 Webbernaut 7
12 Robert DeVore 7
13 Daniel Ruf 5
14 TANG Cheuk Hei (siunam) 5
15 SOPROBRO 5
16 Rafie Muhammad 4
17 Trương Hữu Phúc (truonghuuphuc) 4
18 Colin Xu 4
19 Tonn 4
20 Le Ngoc Anh 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation