WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-4365
Jul 12, 2021
Researcher: Jerome Bruandet
Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails
7.2
CVE-2021-4350
Jul 12, 2021
Researcher: Jerome Bruandet
UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion
7.2
CVE ID Unknown
Jul 12, 2021
Researchers:
Speed Booster Pack PageSpeed Optimization Suite <= 4.1.9. - Authenticated (Admin+) Remote Code Execution
7.2
CVE-2021-24430
Jul 5, 2021
Researcher: RE-ALTER
Photo Gallery by Ays - Responsive Image Gallery <= 4.4.3 - Authenticated Blind SQL Injections
7.2
CVE-2021-24462
Jun 29, 2021
Researcher: To Quang Duong
Quiz Maker <= 6.2.0.8 - SQL Injection
7.2
CVE-2021-24456
Jun 29, 2021
Researcher: To Quang Duong
Poll Maker <= 3.2.0 - SQL Injection
7.2
CVE-2021-24483
Jun 29, 2021
Researcher: To Quang Duong
Secure Copy Content Protection and Content Locking <= 2.6.6 - SQL Injection
7.2
CVE-2021-24484
Jun 29, 2021
Researcher: To Quang Duong
W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension
7.2
CVE-2021-24452
Jun 28, 2021
Researchers:
Side Menu Lite <= 2.2 - SQL Injection
7.2
CVE-2021-24521
Jun 28, 2021
Researcher: pang0lin
Export Users With Meta < 0.6.5 - Authenticated (Admin+) SQL Injection
7.2
CVE-2021-24451
Jun 21, 2021
Researcher: Asif Nawaz Minhas
Event Calendar <= 1.1.44 - Cross-Site Scripting
7.2
CVE ID Unknown
May 31, 2021
Researchers:
Side Menu – add fixed side buttons <= 3.1.3 - SQL Injection
7.2
CVE-2021-24348
May 27, 2021
Researcher: Shreya Pohekar
Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-24350
May 26, 2021
Researcher: Mesut Cetin
FlightLog <= 3.0.2 - Authenticated (Editor+) SQL Injection
7.2
CVE-2021-24336
May 19, 2021
Researcher: Shreya Pohekar
WP Super Cache <= 1.7.2 - Authenticated Remote Code Execution
7.2
CVE-2021-24312
May 14, 2021
Researcher: NGA
Tradetracker-Store < 4.6.60 - Authenticated SQL Injection
7.2
CVE-2021-24778
May 13, 2021
Researcher: Syed Sheeraz Ali
Hotscot Contact Form < 1.3 - SQL Injection
7.2
CVE-2021-24777
May 13, 2021
Researcher: Syed Sheeraz Ali
ReDi Restaurant Reservation <= 21.0307 - Stored Cross-Site Scripting
7.2
CVE-2021-24299
May 9, 2021
Researcher: Bastijn Ouwendijk
College publisher Import <= 0.1 - Arbitrary File Upload
7.2
CVE-2021-24254
Apr 11, 2021
Researcher: Jin Huang
Title CVE ID CVSS Researchers Date
Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting CVE-2021-4365 7.2 Jerome Bruandet July 12, 2021
Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails CVE-2021-4350 7.2 Jerome Bruandet July 12, 2021
UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion 7.2 July 12, 2021
Speed Booster Pack PageSpeed Optimization Suite <= 4.1.9. - Authenticated (Admin+) Remote Code Execution CVE-2021-24430 7.2 RE-ALTER July 5, 2021
Photo Gallery by Ays - Responsive Image Gallery <= 4.4.3 - Authenticated Blind SQL Injections CVE-2021-24462 7.2 To Quang Duong June 29, 2021
Quiz Maker <= 6.2.0.8 - SQL Injection CVE-2021-24456 7.2 To Quang Duong June 29, 2021
Poll Maker <= 3.2.0 - SQL Injection CVE-2021-24483 7.2 To Quang Duong June 29, 2021
Secure Copy Content Protection and Content Locking <= 2.6.6 - SQL Injection CVE-2021-24484 7.2 To Quang Duong June 29, 2021
W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension CVE-2021-24452 7.2 June 28, 2021
Side Menu Lite <= 2.2 - SQL Injection CVE-2021-24521 7.2 pang0lin June 28, 2021
Export Users With Meta < 0.6.5 - Authenticated (Admin+) SQL Injection CVE-2021-24451 7.2 Asif Nawaz Minhas June 21, 2021
Event Calendar <= 1.1.44 - Cross-Site Scripting 7.2 May 31, 2021
Side Menu – add fixed side buttons <= 3.1.3 - SQL Injection CVE-2021-24348 7.2 Shreya Pohekar May 27, 2021
Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting CVE-2021-24350 7.2 Mesut Cetin May 26, 2021
FlightLog <= 3.0.2 - Authenticated (Editor+) SQL Injection CVE-2021-24336 7.2 Shreya Pohekar May 19, 2021
WP Super Cache <= 1.7.2 - Authenticated Remote Code Execution CVE-2021-24312 7.2 NGA May 14, 2021
Tradetracker-Store < 4.6.60 - Authenticated SQL Injection CVE-2021-24778 7.2 Syed Sheeraz Ali May 13, 2021
Hotscot Contact Form < 1.3 - SQL Injection CVE-2021-24777 7.2 Syed Sheeraz Ali May 13, 2021
ReDi Restaurant Reservation <= 21.0307 - Stored Cross-Site Scripting CVE-2021-24299 7.2 Bastijn Ouwendijk May 9, 2021
College publisher Import <= 0.1 - Arbitrary File Upload CVE-2021-24254 7.2 Jin Huang April 11, 2021
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 2, 2024
Vulns
1 Francesco Carlucci 46
2 vgo0 40
3 wesley (wcraft) 22
4 Lucio Sá 14
5 Krzysztof Zając 12
6 stealthcopter 11
7 Peter Thaleikis 11
8 Marco Wotschka 7
9 Webbernaut 7
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 zer0gh0st 4
13 Tonn 4
14 Colin Xu 4
15 Robert DeVore 4
16 LVT-tholv2k 3
17 Le Ngoc Anh 3
18 István Márton 3
19 rezaduty 3
20 theviper17y 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation