WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
iMember360 3.8.012 - 3.9.001 - Remote Code Execution
7.2
CVE-2014-8949
Apr 24, 2014
Researcher: Everett Griffiths
File Gallery < 1.7.9.2 - Remote Code Execution
7.2
CVE-2014-2558
Apr 24, 2014
Researcher: Tom Adams
WordPress Core < 3.8.2 - SQL Injection
7.2
CVE ID Unknown
Apr 9, 2014
Researcher: Tom Adams
GD Star Rating <= 1.9.22 - Blind SQL Injection
7.2
CVE-2014-2839
Mar 28, 2014
Researcher: Tom Adams
Download Manager < 2.5.9 - Stored Cross-Site Scripting
7.2
CVE-2013-7319
Dec 8, 2013
Researcher: Jeroen Diel
Video Metabox <= 1.1 - Stored Cross Site Scripting
7.2
CVE ID Unknown
Oct 15, 2013
Researchers:
Comment Attachment <= 1.5.5 - Cross-Site Scripting
7.2
CVE-2013-6010
Sep 20, 2013
Researcher: Arsan
Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter
7.2
CVE-2013-5098
Jul 23, 2013
Researchers:
Advanced XML Reader Plugin <= 0.3.4 - XML External Entity Injection
7.2
CVE ID Unknown
May 2, 2013
Researcher: system_meltdown
WP FuneralPress <= 1.1.6 - Cross-Site Scripting
7.2
CVE-2013-3529
Mar 31, 2013
Researcher: Rob Armstrong
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 2.55 - SQL Injection
7.2
CVE ID Unknown
Mar 25, 2013
Researchers:
FAQs Manager <= 1.0 - SQL Injection
7.2
CVE ID Unknown
Mar 22, 2013
Researcher: m3tamantra
LeagueManager < 3.8.1 - SQL Injection
7.2
CVE-2013-1852
Mar 13, 2013
Researcher: Joshua Reynolds
Mingle Forum <= 1.0.33.3 - Stored Cross-Site Scripting
7.2
CVE-2013-0734
Feb 20, 2013
Researcher: Charlie Eriksen
Editorial Calendar <= 2.6 - Authenticated (Admin+) SQL Injection
7.2
CVE-2013-10023
Feb 13, 2013
Researchers:
MailPoet Newsletters <= 2.2 - Multiple SQL Injections
7.2
CVE-2013-1408
Feb 3, 2013
Researcher: High-Tech Bridge Security Research Lab
Google XML Sitemaps Generator < 3.2.9 - Authenticated (Admin+) PHP Code Injection
7.2
CVE ID Unknown
Jan 8, 2013
Researcher: Akastep
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 2.53 - SQL Injection
7.2
CVE ID Unknown
Dec 24, 2012
Researcher: Janek Vind
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 3.1.0 - Arbitrary File Deletion
7.2
CVE ID Unknown
Dec 24, 2012
Researcher: Janek Vind
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 2.00 - SQL Injection
7.2
CVE ID Unknown
Dec 24, 2012
Researcher: Janek Vind
Title CVE ID CVSS Researchers Date
iMember360 3.8.012 - 3.9.001 - Remote Code Execution CVE-2014-8949 7.2 Everett Griffiths April 24, 2014
File Gallery < 1.7.9.2 - Remote Code Execution CVE-2014-2558 7.2 Tom Adams April 24, 2014
WordPress Core < 3.8.2 - SQL Injection 7.2 Tom Adams April 9, 2014
GD Star Rating <= 1.9.22 - Blind SQL Injection CVE-2014-2839 7.2 Tom Adams March 28, 2014
Download Manager < 2.5.9 - Stored Cross-Site Scripting CVE-2013-7319 7.2 Jeroen Diel December 8, 2013
Video Metabox <= 1.1 - Stored Cross Site Scripting 7.2 October 15, 2013
Comment Attachment <= 1.5.5 - Cross-Site Scripting CVE-2013-6010 7.2 Arsan September 20, 2013
Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter CVE-2013-5098 7.2 July 23, 2013
Advanced XML Reader Plugin <= 0.3.4 - XML External Entity Injection 7.2 system_meltdown May 2, 2013
WP FuneralPress <= 1.1.6 - Cross-Site Scripting CVE-2013-3529 7.2 Rob Armstrong March 31, 2013
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 2.55 - SQL Injection 7.2 March 25, 2013
FAQs Manager <= 1.0 - SQL Injection 7.2 m3tamantra March 22, 2013
LeagueManager < 3.8.1 - SQL Injection CVE-2013-1852 7.2 Joshua Reynolds March 13, 2013
Mingle Forum <= 1.0.33.3 - Stored Cross-Site Scripting CVE-2013-0734 7.2 Charlie Eriksen February 20, 2013
Editorial Calendar <= 2.6 - Authenticated (Admin+) SQL Injection CVE-2013-10023 7.2 February 13, 2013
MailPoet Newsletters <= 2.2 - Multiple SQL Injections CVE-2013-1408 7.2 High-Tech Bridge Security Research Lab February 3, 2013
Google XML Sitemaps Generator < 3.2.9 - Authenticated (Admin+) PHP Code Injection 7.2 Akastep January 8, 2013
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 2.53 - SQL Injection 7.2 Janek Vind December 24, 2012
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 3.1.0 - Arbitrary File Deletion 7.2 Janek Vind December 24, 2012
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 2.00 - SQL Injection 7.2 Janek Vind December 24, 2012
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 31, 2024
Vulns
1 Francesco Carlucci 43
2 vgo0 36
3 wesley (wcraft) 22
4 Lucio Sá 14
5 Krzysztof Zając 12
6 stealthcopter 11
7 Peter Thaleikis 11
8 Marco Wotschka 7
9 Webbernaut 7
10 Daniel Ruf 5
11 TANG Cheuk Hei (siunam) 5
12 zer0gh0st 4
13 Tonn 4
14 Robert DeVore 3
15 LVT-tholv2k 3
16 Le Ngoc Anh 3
17 István Márton 3
18 rezaduty 3
19 theviper17y 2
20 Michelle Porter 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation