WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WDContactFormBuilder <= 1.0.24 - Authenticated Blind SQL Injection
7.2
CVE ID Unknown
Jul 7, 2015
Researcher: Marcin Probola
WP-CopyProtect [Protect your blog posts] <= 3.0.0 - Cross-Site Scripting
7.2
CVE ID Unknown
Jun 30, 2015
Researcher: James Hooker
NewStatPress <= 1.0.3 - Stored Cross-Site Scripting
7.2
CVE-2015-9314
Jun 30, 2015
Researcher: Michael Kapfer
NextScripts: Social Networks Auto-Poster <= 3.4.17 - Stored Cross-Site Scripting
7.2
CVE ID Unknown
May 25, 2015
Researcher: James Hooker
Free counter <= 1.1 - Stored Cross-Site Scripting
7.2
CVE-2015-4084
May 25, 2015
Researcher: Panagiotis Vagenas
Custom Content Type Manager <= 0.9.8.5 - Authenticated (Admin+) Remote Code Execution
7.2
CVE-2015-3173
May 21, 2015
Researcher: Iain Wallace
Visual Form Builder <= 2.8.2 - Authenticated SQL Injection
7.2
CVE ID Unknown
May 15, 2015
Researcher: Tim Coen
Roomcloud < 1.3 - Cross-Site Scripting
7.2
CVE-2015-3904
May 9, 2015
Researcher: Nitin Venkatesh
WordPress Core < 4.2.2 - Cross-Site Scripting via Comments
7.2
CVE-2015-8834
May 7, 2015
Researchers: Rice Adu, Tong Shi
Jetpack <= 3.5.2 - Cross-Site Scripting
7.2
CVE ID Unknown
May 6, 2015
Researchers:
WordPress Core < 4.2.1 - Cross-Site Scripting via Comments
7.2
CVE-2015-3440
Apr 27, 2015
Researcher: Jouko Pynnöne
WordPress Core < 4.1.2 - Cross-Site Scripting
7.2
CVE-2015-3438
Apr 21, 2015
Researcher: Jakub Zoczek
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.3.3 - Cross-Site Scripting
7.2
CVE ID Unknown
Apr 20, 2015
Researcher: Jouko Pynnöne
WPtouch <= 3.7.5.3 - Cross-Site Scripting
7.2
CVE ID Unknown
Apr 20, 2015
Researcher: DANIEL CID
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.4.95 - SQL Injection
7.2
CVE ID Unknown
Apr 17, 2015
Researchers:
WP Super Cache < 1.4.3 - Cross Site Scripting
7.2
CVE ID Unknown
Apr 7, 2015
Researcher: Marc-Alexandre Montpas
MonsterInsights – Google Analytics Dashboard for WordPress <= 5.3.2 - Stored Cross-Site Scripting
7.2
CVE ID Unknown
Mar 19, 2015
Researcher: Jouko Pynnöne
WooCommerce <= 2.3.5 - Stored Cross-Site Scripting
7.2
CVE-2015-2329
Mar 13, 2015
Researchers:
Responsive Slider – Image Slider – Slideshow for WordPress < 2.7.0 - Authenticated (Admin+) SQL Injection
7.2
CVE-2015-2062
Mar 12, 2015
Researcher: High-Tech Bridge Security Research Lab
WPBakery Page Builder for WordPress (formerly Visual Composer) <= 4.7.3 - Multiple Cross-Site Scripting Issues
7.2
CVE ID Unknown
Feb 10, 2015
Researchers:
Title CVE ID CVSS Researchers Date
WDContactFormBuilder <= 1.0.24 - Authenticated Blind SQL Injection 7.2 Marcin Probola July 7, 2015
WP-CopyProtect [Protect your blog posts] <= 3.0.0 - Cross-Site Scripting 7.2 James Hooker June 30, 2015
NewStatPress <= 1.0.3 - Stored Cross-Site Scripting CVE-2015-9314 7.2 Michael Kapfer June 30, 2015
NextScripts: Social Networks Auto-Poster <= 3.4.17 - Stored Cross-Site Scripting 7.2 James Hooker May 25, 2015
Free counter <= 1.1 - Stored Cross-Site Scripting CVE-2015-4084 7.2 Panagiotis Vagenas May 25, 2015
Custom Content Type Manager <= 0.9.8.5 - Authenticated (Admin+) Remote Code Execution CVE-2015-3173 7.2 Iain Wallace May 21, 2015
Visual Form Builder <= 2.8.2 - Authenticated SQL Injection 7.2 Tim Coen May 15, 2015
Roomcloud < 1.3 - Cross-Site Scripting CVE-2015-3904 7.2 Nitin Venkatesh May 9, 2015
WordPress Core < 4.2.2 - Cross-Site Scripting via Comments CVE-2015-8834 7.2 Rice Adu, Tong Shi May 7, 2015
Jetpack <= 3.5.2 - Cross-Site Scripting 7.2 May 6, 2015
WordPress Core < 4.2.1 - Cross-Site Scripting via Comments CVE-2015-3440 7.2 Jouko Pynnöne April 27, 2015
WordPress Core < 4.1.2 - Cross-Site Scripting CVE-2015-3438 7.2 Jakub Zoczek April 21, 2015
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.3.3 - Cross-Site Scripting 7.2 Jouko Pynnöne April 20, 2015
WPtouch <= 3.7.5.3 - Cross-Site Scripting 7.2 DANIEL CID April 20, 2015
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.4.95 - SQL Injection 7.2 April 17, 2015
WP Super Cache < 1.4.3 - Cross Site Scripting 7.2 Marc-Alexandre Montpas April 7, 2015
MonsterInsights – Google Analytics Dashboard for WordPress <= 5.3.2 - Stored Cross-Site Scripting 7.2 Jouko Pynnöne March 19, 2015
WooCommerce <= 2.3.5 - Stored Cross-Site Scripting CVE-2015-2329 7.2 March 13, 2015
Responsive Slider – Image Slider – Slideshow for WordPress < 2.7.0 - Authenticated (Admin+) SQL Injection CVE-2015-2062 7.2 High-Tech Bridge Security Research Lab March 12, 2015
WPBakery Page Builder for WordPress (formerly Visual Composer) <= 4.7.3 - Multiple Cross-Site Scripting Issues 7.2 February 10, 2015
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 1, 2024
Vulns
1 Francesco Carlucci 43
2 vgo0 36
3 wesley (wcraft) 22
4 Lucio Sá 14
5 Krzysztof Zając 12
6 stealthcopter 11
7 Peter Thaleikis 11
8 Marco Wotschka 7
9 Webbernaut 7
10 Daniel Ruf 5
11 TANG Cheuk Hei (siunam) 5
12 zer0gh0st 4
13 Tonn 4
14 Robert DeVore 3
15 LVT-tholv2k 3
16 Le Ngoc Anh 3
17 István Márton 3
18 rezaduty 3
19 theviper17y 2
20 Michelle Porter 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation