WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Link Library <= 5.9.13.26 – SQL Injection
7.2
CVE ID Unknown
Aug 14, 2017
Researcher: Lenon Leite
Easy Modal < 2.1.0 - Authenticated (Admin+) SQL Injection
7.2
CVE-2017-12946
Aug 7, 2017
Researcher: DefenceCode
Easy Modal < 2.1.0 - SQL Injection
7.2
CVE-2017-12947
Aug 7, 2017
Researcher: Neven Birusk
Arabic Font <= 1.2 Cross-Site Request Forgery to Stored Cross-Site Scripting
7.2
CVE ID Unknown
Jul 20, 2017
Researcher: rastating
DSubscribers < 1.2.1 - Authenticated (Admin+) SQL Injection
7.2
CVE ID Unknown
Jul 6, 2017
Researcher: Lenon Leite
Add Edit Delete Listing Module <= 1.0 - SQL Injection
7.2
CVE-2017-1002025
Jul 5, 2017
Researcher: Larry W. Cashdollar
Gift Certificate Creator <= 1.0 - Stored Cross-Site Scripting
7.2
CVE-2017-1002017
Jun 11, 2017
Researcher: Larry W. Cashdollar
Crelly Slider <= 1.1.1 - SQL Injection
7.2
CVE ID Unknown
Jun 5, 2017
Researchers:
Event List < 0.7.9 - Authenticated (Admin+) SQL Injection
7.2
CVE-2017-9429
Jun 4, 2017
Researcher: Dimitrios Tsagkarakis
cformsII <= 14.12.3 - Authenticated SQL Injection
7.2
CVE-2017-18570
Apr 24, 2017
Researchers:
Mail Masta <= 1.0 - SQL Injection via subscriber_email parameter
7.2
CVE-2017-6578
Mar 9, 2017
Researcher: hamkovic
Mail Masta Plugin <= 1.0 - SQL Injection via filter_list
7.2
CVE-2017-6574
Mar 5, 2017
Researcher: hamkovic
Mail Masta <= 1.0 - SQL Injection via id parameter
7.2
CVE-2017-6576
Mar 5, 2017
Researcher: Hanley Shun
GNUCommerce < 1.4.2 - Stored Cross-Site Scripting
7.2
CVE-2017-18572
Mar 1, 2017
Researchers:
NewStatPress < 1.2.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2017-18575
Mar 1, 2017
Researcher: Han Sahin
Mail Masta <= 1.0 - SQL Injection via camp_id parameter
7.2
CVE-2017-6097
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via id parameter
7.2
CVE-2017-6571
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via id parameter
7.2
CVE-2017-6573
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via list_id parameter
7.2
CVE-2017-6098
Feb 18, 2017
Researcher: Hanley Shun
Mail Masta <= 1.0 - SQL Injection via filter_list parameter
7.2
CVE-2017-6572
Feb 18, 2017
Researcher: Hanley Shun
Title CVE ID CVSS Researchers Date
Link Library <= 5.9.13.26 – SQL Injection 7.2 Lenon Leite August 14, 2017
Easy Modal < 2.1.0 - Authenticated (Admin+) SQL Injection CVE-2017-12946 7.2 DefenceCode August 7, 2017
Easy Modal < 2.1.0 - SQL Injection CVE-2017-12947 7.2 Neven Birusk August 7, 2017
Arabic Font <= 1.2 Cross-Site Request Forgery to Stored Cross-Site Scripting 7.2 rastating July 20, 2017
DSubscribers < 1.2.1 - Authenticated (Admin+) SQL Injection 7.2 Lenon Leite July 6, 2017
Add Edit Delete Listing Module <= 1.0 - SQL Injection CVE-2017-1002025 7.2 Larry W. Cashdollar July 5, 2017
Gift Certificate Creator <= 1.0 - Stored Cross-Site Scripting CVE-2017-1002017 7.2 Larry W. Cashdollar June 11, 2017
Crelly Slider <= 1.1.1 - SQL Injection 7.2 June 5, 2017
Event List < 0.7.9 - Authenticated (Admin+) SQL Injection CVE-2017-9429 7.2 Dimitrios Tsagkarakis June 4, 2017
cformsII <= 14.12.3 - Authenticated SQL Injection CVE-2017-18570 7.2 April 24, 2017
Mail Masta <= 1.0 - SQL Injection via subscriber_email parameter CVE-2017-6578 7.2 hamkovic March 9, 2017
Mail Masta Plugin <= 1.0 - SQL Injection via filter_list CVE-2017-6574 7.2 hamkovic March 5, 2017
Mail Masta <= 1.0 - SQL Injection via id parameter CVE-2017-6576 7.2 Hanley Shun March 5, 2017
GNUCommerce < 1.4.2 - Stored Cross-Site Scripting CVE-2017-18572 7.2 March 1, 2017
NewStatPress < 1.2.5 - Unauthenticated Stored Cross-Site Scripting CVE-2017-18575 7.2 Han Sahin March 1, 2017
Mail Masta <= 1.0 - SQL Injection via camp_id parameter CVE-2017-6097 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via id parameter CVE-2017-6571 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via id parameter CVE-2017-6573 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via list_id parameter CVE-2017-6098 7.2 Hanley Shun February 18, 2017
Mail Masta <= 1.0 - SQL Injection via filter_list parameter CVE-2017-6572 7.2 Hanley Shun February 18, 2017
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 1, 2024
Vulns
1 Francesco Carlucci 43
2 vgo0 36
3 wesley (wcraft) 22
4 Lucio Sá 14
5 Krzysztof Zając 12
6 stealthcopter 11
7 Peter Thaleikis 11
8 Marco Wotschka 7
9 Webbernaut 7
10 Daniel Ruf 5
11 TANG Cheuk Hei (siunam) 5
12 zer0gh0st 4
13 Tonn 4
14 Robert DeVore 3
15 LVT-tholv2k 3
16 Le Ngoc Anh 3
17 István Márton 3
18 rezaduty 3
19 theviper17y 2
20 Michelle Porter 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation