WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Business Directory Plugin <= 5.11 - Authenticated PHP4 Upload
7.2
CVE-2021-24248
Apr 11, 2021
Researcher: 0xB9
Event Banner <= 1.3 - Cross-Site Request Forgery
7.2
CVE-2021-24252
Apr 10, 2021
Researcher: Jin Huang
Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections
7.2
CVE ID Unknown
Apr 5, 2021
Researcher: Martin Vierula
WP Super Cache <= 1.7.1 - Authenticated (Admin+) Remote Code Execution
7.2
CVE-2021-24209
Mar 16, 2021
Researcher: RE-ALTER
Under Construction, Coming Soon & Maintenance Mode <= 1.1.1 - Server Side Request Forgery
7.2
CVE ID Unknown
Feb 27, 2021
Researcher: Mr.F
Backup Guard <= 1.5.9 - Authenticated Arbitrary File Upload
7.2
CVE-2021-24155
Feb 18, 2021
Researcher: Nguyen Van Khanh
Map Block for Google Maps <= 1.31 - Unprotected AJAX Action
7.2
CVE ID Unknown
Feb 10, 2021
Researchers:
Newsletter by Supsystic <= 1.5.6 - Authenticated (Admin+) Time-Based Blind SQL Injection
7.2
CVE ID Unknown
Feb 8, 2021
Researcher: Erik David Martin
Ultimate Maps by Supsystic <= 1.1.16 - Authenticated SQL Injection
7.2
CVE ID Unknown
Feb 8, 2021
Researchers:
Membership by Supsystic <= 1.5.0 - Authenticated (Admin+) Time-Based Blind SQL Injection
7.2
CVE ID Unknown
Feb 8, 2021
Researcher: Erik David Martin
WP Editor <= 1.2.6.3 - Authenticated (Admin+) SQL injection
7.2
CVE-2021-24151
Feb 1, 2021
Researcher: Nguyen Van Khanh
Modern Events Calendar Lite <= 5.16.4 - Authenticated Arbitrary File Upload leading to Remote Code Execution
7.2
CVE-2021-24145
Jan 29, 2021
Researcher: Nguyen Van Khanh
301 Redirects - Easy Redirect Manager < 2.51 - SQL Injection
7.2
CVE-2021-24142
Jan 18, 2021
Researcher: Nguyen Van Khanh
Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2021-25080
Jan 5, 2021
Researcher: Gaetano Perrone
Contact Form Submissions <= 1.7 - Authenticated SQL Injection
7.2
CVE-2021-24125
Jan 3, 2021
Researchers: minhtuanact, vigov5 SunCSR
WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby
7.2
CVE-2021-24130
Nov 25, 2020
Researcher: Nguyen Anh Tien
Anti-Spam by CleanTalk < 5.149 - Authenticated SQL Injection
7.2
CVE-2021-24131
Nov 20, 2020
Researcher: Nguyen Anh Tien
Mailster <= 2.4.5.1 - Stored Cross-Site Scripting
7.2
CVE ID Unknown
Oct 14, 2020
Researcher: Thierry Viaccoz
Web Instant Messenger <= 1.1.2 and LocalWeb In One <= 1.6.4 - Stored Cross-Site Scripting
7.2
CVE ID Unknown
Oct 12, 2020
Researcher: RE-ALTER
PowerPress <= 8.3.7 - Arbitrary File Upload
7.2
CVE-2021-24123
Oct 11, 2020
Researcher: Minh Tuan - SunCSR (Sun* Cyber Security Research)
Title CVE ID CVSS Researchers Date
Business Directory Plugin <= 5.11 - Authenticated PHP4 Upload CVE-2021-24248 7.2 0xB9 April 11, 2021
Event Banner <= 1.3 - Cross-Site Request Forgery CVE-2021-24252 7.2 Jin Huang April 10, 2021
Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections 7.2 Martin Vierula April 5, 2021
WP Super Cache <= 1.7.1 - Authenticated (Admin+) Remote Code Execution CVE-2021-24209 7.2 RE-ALTER March 16, 2021
Under Construction, Coming Soon & Maintenance Mode <= 1.1.1 - Server Side Request Forgery 7.2 Mr.F February 27, 2021
Backup Guard <= 1.5.9 - Authenticated Arbitrary File Upload CVE-2021-24155 7.2 Nguyen Van Khanh February 18, 2021
Map Block for Google Maps <= 1.31 - Unprotected AJAX Action 7.2 February 10, 2021
Newsletter by Supsystic <= 1.5.6 - Authenticated (Admin+) Time-Based Blind SQL Injection 7.2 Erik David Martin February 8, 2021
Ultimate Maps by Supsystic <= 1.1.16 - Authenticated SQL Injection 7.2 February 8, 2021
Membership by Supsystic <= 1.5.0 - Authenticated (Admin+) Time-Based Blind SQL Injection 7.2 Erik David Martin February 8, 2021
WP Editor <= 1.2.6.3 - Authenticated (Admin+) SQL injection CVE-2021-24151 7.2 Nguyen Van Khanh February 1, 2021
Modern Events Calendar Lite <= 5.16.4 - Authenticated Arbitrary File Upload leading to Remote Code Execution CVE-2021-24145 7.2 Nguyen Van Khanh January 29, 2021
301 Redirects - Easy Redirect Manager < 2.51 - SQL Injection CVE-2021-24142 7.2 Nguyen Van Khanh January 18, 2021
Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting CVE-2021-25080 7.2 Gaetano Perrone January 5, 2021
Contact Form Submissions <= 1.7 - Authenticated SQL Injection CVE-2021-24125 7.2 minhtuanact, vigov5 SunCSR January 3, 2021
WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby CVE-2021-24130 7.2 Nguyen Anh Tien November 25, 2020
Anti-Spam by CleanTalk < 5.149 - Authenticated SQL Injection CVE-2021-24131 7.2 Nguyen Anh Tien November 20, 2020
Mailster <= 2.4.5.1 - Stored Cross-Site Scripting 7.2 Thierry Viaccoz October 14, 2020
Web Instant Messenger <= 1.1.2 and LocalWeb In One <= 1.6.4 - Stored Cross-Site Scripting 7.2 RE-ALTER October 12, 2020
PowerPress <= 8.3.7 - Arbitrary File Upload CVE-2021-24123 7.2 Minh Tuan - SunCSR (Sun* Cyber Security Research) October 11, 2020
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 2, 2024
Vulns
1 Francesco Carlucci 46
2 vgo0 40
3 wesley (wcraft) 22
4 Lucio Sá 14
5 Krzysztof Zając 12
6 stealthcopter 11
7 Peter Thaleikis 11
8 Marco Wotschka 7
9 Webbernaut 7
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 zer0gh0st 4
13 Tonn 4
14 Colin Xu 4
15 Robert DeVore 4
16 LVT-tholv2k 3
17 Le Ngoc Anh 3
18 István Márton 3
19 rezaduty 3
20 theviper17y 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation