WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WP Review Slider < 11.0 - SQL Injection
7.2
CVE-2022-0383
Jan 31, 2022
Researcher: Felipe de Avila
AP Custom Testimonial <= 1.4.7 - SQL Injection
7.2
CVE-2022-23911
Jan 25, 2022
Researcher: castilho
Database Backup for WordPress <= 2.5 - Admin+ SQL Injection
7.2
CVE-2022-0255
Jan 24, 2022
Researcher: ZhongFu Su
Popup Builder <= 4.0.6 - Authenticated SQL Injection via order & orderby Parameters
7.2
CVE-2022-0228
Jan 24, 2022
Researcher: Tony Wu
Futurio Extra <= 1.6.2 - Authenticated (Admin+) SQL Injection
7.2
CVE-2021-25109
Jan 4, 2022
Researcher: Jan w Oleju
WP Photo Album Plus <= 8.0.10 - Stored Cross-Site Scripting
7.2
CVE-2021-25115
Jan 2, 2022
Researcher: Krzysztof Zając
Cookie Notification Plugin for WordPress < 1.0.9 - SQL Injection
7.2
CVE-2021-24858
Dec 27, 2021
Researcher: Shreya Pohekar
Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting
7.2
CVE ID Unknown
Dec 27, 2021
Researcher: creadpag
Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection
7.2
CVE-2021-24865
Dec 24, 2021
Researcher: ZhongFu Su
Affiliates Manager <= 2.8.9 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-25078
Dec 24, 2021
Researcher: Krzysztof Zając
Asgaros Forum <= 1.15.14 - Admin+ SQL Injection via forum_id
7.2
CVE-2021-25045
Dec 21, 2021
Researcher: Trang LKB
Site Reviews <= 5.17.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-24973
Dec 6, 2021
Researcher: Krzysztof Zając
Survey Maker <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-26256
Dec 3, 2021
Researcher: Ngo Van Thien
Contact Form & Lead Form Elementor Builder <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-24967
Nov 29, 2021
Researcher: Krzysztof Zając
Tickera <= 3.4.8.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-24797
Nov 23, 2021
Researcher: Ajit Bhatta
ExportFeed <= 2.0.1.0 - SQL Injection
7.2
CVE-2021-4208
Nov 22, 2021
Researcher: 0xdecafbad
Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
7.2
CVE-2022-0889
Nov 20, 2021
Researchers: Nuno Correia (Blaze Security), Muhammad Zeeshan (Xib3rR4dAr)
WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress < 3.5.25 - Authenticated (Admin+) SQL Injection
7.2
CVE ID Unknown
Nov 18, 2021
Researchers:
All-In-One-Gallery <= 2.4.9 - Admin+ Local File Inclusion
7.2
CVE-2021-24970
Nov 15, 2021
Researcher: Mohamed Magdy AbuMuslim
SEO Booster <= 3.7 - Admin+ SQL Injection
7.2
CVE-2021-24747
Nov 15, 2021
Researcher: bl4derunner
Title CVE ID CVSS Researchers Date
WP Review Slider < 11.0 - SQL Injection CVE-2022-0383 7.2 Felipe de Avila January 31, 2022
AP Custom Testimonial <= 1.4.7 - SQL Injection CVE-2022-23911 7.2 castilho January 25, 2022
Database Backup for WordPress <= 2.5 - Admin+ SQL Injection CVE-2022-0255 7.2 ZhongFu Su January 24, 2022
Popup Builder <= 4.0.6 - Authenticated SQL Injection via order & orderby Parameters CVE-2022-0228 7.2 Tony Wu January 24, 2022
Futurio Extra <= 1.6.2 - Authenticated (Admin+) SQL Injection CVE-2021-25109 7.2 Jan w Oleju January 4, 2022
WP Photo Album Plus <= 8.0.10 - Stored Cross-Site Scripting CVE-2021-25115 7.2 Krzysztof Zając January 2, 2022
Cookie Notification Plugin for WordPress < 1.0.9 - SQL Injection CVE-2021-24858 7.2 Shreya Pohekar December 27, 2021
Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting 7.2 creadpag December 27, 2021
Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection CVE-2021-24865 7.2 ZhongFu Su December 24, 2021
Affiliates Manager <= 2.8.9 - Unauthenticated Stored Cross-Site Scripting CVE-2021-25078 7.2 Krzysztof Zając December 24, 2021
Asgaros Forum <= 1.15.14 - Admin+ SQL Injection via forum_id CVE-2021-25045 7.2 Trang LKB December 21, 2021
Site Reviews <= 5.17.2 - Unauthenticated Stored Cross-Site Scripting CVE-2021-24973 7.2 Krzysztof Zając December 6, 2021
Survey Maker <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting CVE-2021-26256 7.2 Ngo Van Thien December 3, 2021
Contact Form & Lead Form Elementor Builder <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting CVE-2021-24967 7.2 Krzysztof Zając November 29, 2021
Tickera <= 3.4.8.2 - Unauthenticated Stored Cross-Site Scripting CVE-2021-24797 7.2 Ajit Bhatta November 23, 2021
ExportFeed <= 2.0.1.0 - SQL Injection CVE-2021-4208 7.2 0xdecafbad November 22, 2021
Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting CVE-2022-0889 7.2 Nuno Correia (Blaze Security), Muhammad Zeeshan (Xib3rR4dAr) November 20, 2021
WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress < 3.5.25 - Authenticated (Admin+) SQL Injection 7.2 November 18, 2021
All-In-One-Gallery <= 2.4.9 - Admin+ Local File Inclusion CVE-2021-24970 7.2 Mohamed Magdy AbuMuslim November 15, 2021
SEO Booster <= 3.7 - Admin+ SQL Injection CVE-2021-24747 7.2 bl4derunner November 15, 2021
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 2, 2024
Vulns
1 Francesco Carlucci 46
2 vgo0 40
3 wesley (wcraft) 22
4 Lucio Sá 14
5 Krzysztof Zając 12
6 stealthcopter 11
7 Peter Thaleikis 11
8 Marco Wotschka 7
9 Webbernaut 7
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 zer0gh0st 4
13 Tonn 4
14 Colin Xu 4
15 Robert DeVore 4
16 LVT-tholv2k 3
17 Le Ngoc Anh 3
18 István Márton 3
19 rezaduty 3
20 theviper17y 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation