🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode

4.3

CVE-2023-6504

Jan 5, 2024

Researcher: Francesco Carlucci

Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

6.4

CVE-2023-6938

Jan 5, 2024

Researcher: Francesco Carlucci

WooCommerce <= 8.2.2 - Cross-Site Request Forgery

4.3

CVE-2023-52222

Jan 5, 2024

Researcher: Rafie Muhammad

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2023-6801

Jan 5, 2024

Researcher: Colin Xu

WP Job Manager <= 2.0.0 - Cross-Site Request Forgery

4.3

CVE-2023-52212

Jan 5, 2024

Researcher: Rafie Muhammad

Icegram <= 3.1.21 - Missing Authorization

4.3

CVE-2024-21748

Jan 5, 2024

Researcher: Huynh Tien Si

Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting

6.1

CVE-2023-6632

Jan 5, 2024

Researcher: xEHLE

Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection

8.8

CVE-2023-52219

Jan 5, 2024

Researcher: Rafie Muhammad

Wp Ultimate Review <= 2.3.4 - IP Spoofing

5.3

CVE-2024-21746

Jan 5, 2024

Researcher: Mika

Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields

6.4

CVE-2023-6781

Jan 5, 2024

Researcher: Nex Team

Quiz Maker <= 6.5.1.1 - Missing Authorization

4.3

CVE-2024-21743

Jan 5, 2024

Researcher: Abdi Pranata

Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access

5.3

CVE-2023-7199

Jan 4, 2024

Researcher: Krzysztof Zając

Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save

4.3

CVE-2023-6493

Jan 4, 2024

Researcher: Rafshanzani Suhada

Cloudflare <= 4.12.2 - Missing Authorization via initProxy

6.4

CVE-2024-0212

Jan 4, 2024

Researchers:

Ajax Search Lite <= 4.11.4 - Reflected Cross-Site Scripting

6.1

CVE-2024-21752

Jan 4, 2024

Researcher: Le Ngoc Anh

Easy SVG Allow <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

6.4

CVE-2023-7089

Jan 3, 2024

Researcher: Bob Matyas

HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton

8.8

CVE-2023-52207

Jan 3, 2024

Researcher: Rafie Muhammad

Constant Contact Forms <= 2.4.2 - Information Disclosure via Log Files

5.3

CVE-2023-52208

Jan 3, 2024

Researcher: Joshua Chan

Page Builder: Live Composer <= 1.5.25 - Authenticated (Author+) PHP Object Injection

8.8

CVE-2023-52206

Jan 3, 2024

Researcher: Le Ngoc Anh

LearnPress <= 4.2.5.7 - Command Injection

8.1

CVE-2023-6634

Jan 3, 2024

Researcher: hir0ot

Title	CVE ID	CVSS	Researchers	Date
Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode	CVE-2023-6504	4.3	Francesco Carlucci	January 5, 2024
Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field	CVE-2023-6938	6.4	Francesco Carlucci	January 5, 2024
WooCommerce <= 8.2.2 - Cross-Site Request Forgery	CVE-2023-52222	4.3	Rafie Muhammad	January 5, 2024
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting	CVE-2023-6801	6.4	Colin Xu	January 5, 2024
WP Job Manager <= 2.0.0 - Cross-Site Request Forgery	CVE-2023-52212	4.3	Rafie Muhammad	January 5, 2024
Icegram <= 3.1.21 - Missing Authorization	CVE-2024-21748	4.3	Huynh Tien Si	January 5, 2024
Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting	CVE-2023-6632	6.1	xEHLE	January 5, 2024
Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection	CVE-2023-52219	8.8	Rafie Muhammad	January 5, 2024
Wp Ultimate Review <= 2.3.4 - IP Spoofing	CVE-2024-21746	5.3	Mika	January 5, 2024
Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields	CVE-2023-6781	6.4	Nex Team	January 5, 2024
Quiz Maker <= 6.5.1.1 - Missing Authorization	CVE-2024-21743	4.3	Abdi Pranata	January 5, 2024
Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access	CVE-2023-7199	5.3	Krzysztof Zając	January 4, 2024
Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save	CVE-2023-6493	4.3	Rafshanzani Suhada	January 4, 2024
Cloudflare <= 4.12.2 - Missing Authorization via initProxy	CVE-2024-0212	6.4		January 4, 2024
Ajax Search Lite <= 4.11.4 - Reflected Cross-Site Scripting	CVE-2024-21752	6.1	Le Ngoc Anh	January 4, 2024
Easy SVG Allow <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG	CVE-2023-7089	6.4	Bob Matyas	January 3, 2024
HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton	CVE-2023-52207	8.8	Rafie Muhammad	January 3, 2024
Constant Contact Forms <= 2.4.2 - Information Disclosure via Log Files	CVE-2023-52208	5.3	Joshua Chan	January 3, 2024
Page Builder: Live Composer <= 1.5.25 - Authenticated (Author+) PHP Object Injection	CVE-2023-52206	8.8	Le Ngoc Anh	January 3, 2024
LearnPress <= 4.2.5.7 - Command Injection	CVE-2023-6634	8.1	hir0ot	January 3, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 31, 2024 Vulns
1	Francesco Carlucci	30
2	vgo0	27
3	wesley (wcraft)	21
4	Lucio Sá	13
5	Krzysztof Zając	10
6	stealthcopter	10
7	Peter Thaleikis	7
8	Marco Wotschka	7
9	Webbernaut	6
10	TANG Cheuk Hei (siunam)	5
11	Daniel Ruf	5
12	zer0gh0st	4
13	LVT-tholv2k	3
14	Robert DeVore	3
15	Le Ngoc Anh	3
16	rezaduty	3
17	Rafie Muhammad	2
18	Tonn	2
19	Jorge Diaz (ddiax)	2
20	Michelle Porter	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation