🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Asgaros Forum <= 2.7.2 - Unauthenticated PHP Object Injection in prepare_unread_status

9.8

CVE-2024-22284

Jan 16, 2024

Researcher: Le Ngoc Anh

WOLF <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via profile_title

6.1

CVE-2024-22159

Jan 16, 2024

Researcher: thiennv

Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure

4.3

CVE-2023-6983

Jan 16, 2024

Researcher: Francesco Carlucci

CformsII <= 15.0.5 - Unauthenticated stored Cross-Site Scripting

7.2

CVE-2024-22149

Jan 15, 2024

Researcher: emad

WP Smart Editor <= 1.3.3 - Reflected Cross-Site Scripting

6.1

CVE-2024-22148

Jan 15, 2024

Researcher: Dimas Maulana

Product Enquiry for WooCommerce <= 3.1 - Reflected Cross-Site Scripting

6.1

CVE-2023-7151

Jan 15, 2024

Researcher: Erwan LR

Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget

6.4

CVE-2024-0508

Jan 15, 2024

Researcher: Webbernaut

The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure

5.3

CVE-2023-6557

Jan 12, 2024

Researcher: Nicolas Decayeux

WooCommerce < 8.4.0 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

Jan 12, 2024

Researchers:

Spiffy Calendar <= 4.9.8 - Insufficient Authorization

4.3

CVE-2024-0855

Jan 12, 2024

Researcher: cyc707

WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE ID Unknown

Jan 12, 2024

Researchers:

Index Now <= 2.6.3 - Cross-Site Request Forgery via reset_form

7.1

CVE-2024-0428

Jan 12, 2024

Researcher: Francesco Carlucci

Ultimate Maps by Supsystic <= 1.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-6732

Jan 12, 2024

Researcher: Mert Umut

WP Spell Check <= 9.17 - Cross-Site Request Forgery

4.3

CVE-2024-22143

Jan 12, 2024

Researcher: Mika

Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVE-2023-6884

Jan 12, 2024

Researcher: Akbar Kustirama

PDF Invoices & Packing Slips for WooCommerce <= 3.7.6 - Authenticated (Shop Manager+) SQL Injection

7.2

CVE-2024-22147

Jan 12, 2024

Researcher: beluga

Schema & Structured Data for WP & AMP <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVE-2024-22146

Jan 12, 2024

Researcher: LVT-tholv2k

WP Testimonials <= 1.4.3 - Authenticated (Contributor+) SQL Injection

8.8

CVE-2024-25924

Jan 12, 2024

Researcher: Le Ngoc Anh

InstaWP Connect <= 0.1.0.8 - Cross-Site Request Forgery via create_file_db_manager

4.3

CVE ID Unknown

Jan 12, 2024

Researchers:

Quiz Maker <= 6.5.0.5 - Denial of Service

5.3

CVE-2024-22027

Jan 12, 2024

Researcher: Shogo Kumamaru

Title	CVE ID	CVSS	Researchers	Date
Asgaros Forum <= 2.7.2 - Unauthenticated PHP Object Injection in prepare_unread_status	CVE-2024-22284	9.8	Le Ngoc Anh	January 16, 2024
WOLF <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via profile_title	CVE-2024-22159	6.1	thiennv	January 16, 2024
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure	CVE-2023-6983	4.3	Francesco Carlucci	January 16, 2024
CformsII <= 15.0.5 - Unauthenticated stored Cross-Site Scripting	CVE-2024-22149	7.2	emad	January 15, 2024
WP Smart Editor <= 1.3.3 - Reflected Cross-Site Scripting	CVE-2024-22148	6.1	Dimas Maulana	January 15, 2024
Product Enquiry for WooCommerce <= 3.1 - Reflected Cross-Site Scripting	CVE-2023-7151	6.1	Erwan LR	January 15, 2024
Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget	CVE-2024-0508	6.4	Webbernaut	January 15, 2024
The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure	CVE-2023-6557	5.3	Nicolas Decayeux	January 12, 2024
WooCommerce < 8.4.0 - Reflected Cross-Site Scripting		6.1		January 12, 2024
Spiffy Calendar <= 4.9.8 - Insufficient Authorization	CVE-2024-0855	4.3	cyc707	January 12, 2024
WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting		6.4		January 12, 2024
Index Now <= 2.6.3 - Cross-Site Request Forgery via reset_form	CVE-2024-0428	7.1	Francesco Carlucci	January 12, 2024
Ultimate Maps by Supsystic <= 1.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2023-6732	4.4	Mert Umut	January 12, 2024
WP Spell Check <= 9.17 - Cross-Site Request Forgery	CVE-2024-22143	4.3	Mika	January 12, 2024
Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode	CVE-2023-6884	6.4	Akbar Kustirama	January 12, 2024
PDF Invoices & Packing Slips for WooCommerce <= 3.7.6 - Authenticated (Shop Manager+) SQL Injection	CVE-2024-22147	7.2	beluga	January 12, 2024
Schema & Structured Data for WP & AMP <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-22146	5.4	LVT-tholv2k	January 12, 2024
WP Testimonials <= 1.4.3 - Authenticated (Contributor+) SQL Injection	CVE-2024-25924	8.8	Le Ngoc Anh	January 12, 2024
InstaWP Connect <= 0.1.0.8 - Cross-Site Request Forgery via create_file_db_manager		4.3		January 12, 2024
Quiz Maker <= 6.5.0.5 - Denial of Service	CVE-2024-22027	5.3	Shogo Kumamaru	January 12, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 31, 2024 Vulns
1	Francesco Carlucci	38
2	vgo0	30
3	wesley (wcraft)	22
4	Lucio Sá	13
5	Krzysztof Zając	12
6	stealthcopter	11
7	Peter Thaleikis	10
8	Marco Wotschka	7
9	Webbernaut	7
10	TANG Cheuk Hei (siunam)	5
11	Daniel Ruf	5
12	zer0gh0st	4
13	LVT-tholv2k	3
14	Robert DeVore	3
15	Le Ngoc Anh	3
16	rezaduty	3
17	István Márton	3
18	Jorge Diaz (ddiax)	2
19	Connor Billings	2
20	Ankit Patel	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation