WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Rencontre – Dating Site <= 3.1.2 - SQL Injection
7.2
CVE-2019-13413
Jul 8, 2019
Researcher: Admavidhya N
MyBookTable Bookstore <= 3.2.2 - Reflected Cross-Site Scripting
7.2
CVE ID Unknown
Jul 3, 2019
Researchers:
WooCommerce <= 3.6.4 - Missing File Type Validation
7.2
CVE ID Unknown
Jul 2, 2019
Researchers:
WP Statistics <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting via IP Manipulation
7.2
CVE ID Unknown
Jul 1, 2019
Researcher: Antony Garand
Live Chat Unlimited <= 2.8.3 - Stored Cross-Site Scripting
7.2
CVE ID Unknown
Jun 26, 2019
Researcher: RE-ALTER
Intelligent WordPress Live Chat Support Plugin | Utilities <= 1.0.4 - Stored Cross-Site Scripting
7.2
CVE ID Unknown
Jun 25, 2019
Researcher: RE-ALTER
Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link
7.2
CVE-2019-25147
Jun 19, 2019
Researcher: Jerome Bruandet
Rank Math SEO <= 1.0.26 - Cross-Site Scripting
7.2
CVE ID Unknown
Jun 18, 2019
Researchers:
Paid Memberships Pro <= 2.0.5 - Open Redirect
7.2
CVE ID Unknown
Jun 1, 2019
Researchers:
Zoho SalesIQ <= 1.0.8 - Stored Cross-Site Scripting
7.2
CVE-2019-15644
May 31, 2019
Researcher: Kouhei Ikeda
Hostel <= 1.1.3 - Stored Cross-Site Scripting
7.2
CVE-2019-12345
May 25, 2019
Researcher: Admavidhya N
Event Management Tickets Booking By Event Monster Plugin < 1.0.6 - Cross-Site Scripting
7.2
CVE ID Unknown
May 23, 2019
Researcher: Admavidhya N
Live Chat with Messenger Customer Chat <= 1.4.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE ID Unknown
May 17, 2019
Researchers:
Advanced Woo Search <= 1.68 - Cross-Site Scripting
7.2
CVE ID Unknown
May 2, 2019
Researchers:
Blog Designer <=1.8.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE ID Unknown
May 1, 2019
Researcher: Luka Sikic
Yuzo Related Posts <= 5.12.93 - Missing Authorization to Stored Cross-Site Scripting
7.2
CVE-2019-11869
Apr 10, 2019
Researcher: Daniel van Dorp
PWA for WP & AMP Plugin <= 1.0.8 - Cross-Site Scripting
7.2
CVE ID Unknown
Mar 25, 2019
Researchers:
Social Warfare <= 3.5.2 - Unauthenticated Arbitrary Settings Update
7.2
CVE-2019-9978
Mar 21, 2019
Researcher: Andrew Wilder
Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting
7.2
CVE-2019-25152
Mar 11, 2019
Researchers:
Rencontre – Dating Site <= 3.2.1 - Authenticated (Admin+) SQL Injection
7.2
CVE ID Unknown
Mar 8, 2019
Researcher: Sathish Kumar
Title CVE ID CVSS Researchers Date
Rencontre – Dating Site <= 3.1.2 - SQL Injection CVE-2019-13413 7.2 Admavidhya N July 8, 2019
MyBookTable Bookstore <= 3.2.2 - Reflected Cross-Site Scripting 7.2 July 3, 2019
WooCommerce <= 3.6.4 - Missing File Type Validation 7.2 July 2, 2019
WP Statistics <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting via IP Manipulation 7.2 Antony Garand July 1, 2019
Live Chat Unlimited <= 2.8.3 - Stored Cross-Site Scripting 7.2 RE-ALTER June 26, 2019
Intelligent WordPress Live Chat Support Plugin | Utilities <= 1.0.4 - Stored Cross-Site Scripting 7.2 RE-ALTER June 25, 2019
Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link CVE-2019-25147 7.2 Jerome Bruandet June 19, 2019
Rank Math SEO <= 1.0.26 - Cross-Site Scripting 7.2 June 18, 2019
Paid Memberships Pro <= 2.0.5 - Open Redirect 7.2 June 1, 2019
Zoho SalesIQ <= 1.0.8 - Stored Cross-Site Scripting CVE-2019-15644 7.2 Kouhei Ikeda May 31, 2019
Hostel <= 1.1.3 - Stored Cross-Site Scripting CVE-2019-12345 7.2 Admavidhya N May 25, 2019
Event Management Tickets Booking By Event Monster Plugin < 1.0.6 - Cross-Site Scripting 7.2 Admavidhya N May 23, 2019
Live Chat with Messenger Customer Chat <= 1.4.6 - Unauthenticated Stored Cross-Site Scripting 7.2 May 17, 2019
Advanced Woo Search <= 1.68 - Cross-Site Scripting 7.2 May 2, 2019
Blog Designer <=1.8.10 - Unauthenticated Stored Cross-Site Scripting 7.2 Luka Sikic May 1, 2019
Yuzo Related Posts <= 5.12.93 - Missing Authorization to Stored Cross-Site Scripting CVE-2019-11869 7.2 Daniel van Dorp April 10, 2019
PWA for WP & AMP Plugin <= 1.0.8 - Cross-Site Scripting 7.2 March 25, 2019
Social Warfare <= 3.5.2 - Unauthenticated Arbitrary Settings Update CVE-2019-9978 7.2 Andrew Wilder March 21, 2019
Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting CVE-2019-25152 7.2 March 11, 2019
Rencontre – Dating Site <= 3.2.1 - Authenticated (Admin+) SQL Injection 7.2 Sathish Kumar March 8, 2019
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 1, 2024
Vulns
1 Francesco Carlucci 44
2 vgo0 39
3 wesley (wcraft) 22
4 Lucio Sá 14
5 Krzysztof Zając 12
6 stealthcopter 11
7 Peter Thaleikis 11
8 Marco Wotschka 7
9 Webbernaut 7
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 zer0gh0st 4
13 Tonn 4
14 Robert DeVore 3
15 LVT-tholv2k 3
16 Le Ngoc Anh 3
17 István Márton 3
18 rezaduty 3
19 theviper17y 2
20 Colin Xu 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation