WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Quttera Web Malware Scanner <= 3.4.1.48 - Authenticated (Administrator+) Directory Traversal via ShowFile
6.8
CVE-2023-6222
Nov 21, 2023
Researcher: Dmitrii Ignatyev
Post to CSV by BestWebSoft <= 1.3.8 - Authenticated (Author+) CSV Injection
6.8
CVE-2022-3393
Oct 3, 2022
Researcher: Francesco Carlucci
Download Monitor <= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download
6.8
CVE-2022-2981
Sep 19, 2022
Researcher: Raad Haddad
Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal
6.8
CVE ID Unknown
Sep 19, 2022
Researcher: Sybre Waaijer
Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal
6.8
CVE-2022-2554
Sep 14, 2022
Researcher: Raad Haddad
Database Management tool – Adminer <= 1.1.5 - Information Exposure
6.8
CVE ID Unknown
Aug 16, 2022
Researchers:
VR Calendar <= 2.4.0 - Authenticated (Administrator+) Local File Inclusion
6.8
CVE ID Unknown
Jul 28, 2022
Researcher: WPScanTeam
Music Player for WooCommerce <= 1.0.172 - Authenticated (Admin+) Stored Cross-Site Scripting
6.8
CVE ID Unknown
Jun 30, 2022
Researchers:
CaPa Protect <= 0.5.8.2 - Cross-Site Request Forgery to Settings Update
6.8
CVE-2022-1832
May 30, 2022
Researcher: Daniel Ruf
Popup Box <= 2.1.2 - Authenticated Local File Inclusion
6.8
CVE-2022-29445
May 17, 2022
Researcher: 0xB9
Counter Box <= 1.1.1 - Authenticated Local File Inclusion
6.8
CVE-2022-29446
May 16, 2022
Researcher: 0xB9
Hover Effects – easily create any hover effect <= 2.1 - Authenticated Local File Inclusion
6.8
CVE-2022-29447
May 16, 2022
Researcher: 0xB9
iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip
6.8
CVE-2022-0246
Mar 16, 2022
Researcher: Ceylan Bozogullarindan
Download Monitor <= 4.4.6 - Authenticated (Admin+) Arbitrary File Download
6.8
CVE-2021-31567
Oct 29, 2021
Researcher: RE-ALTER
WordPress Core 5.8 beta - Block Editor Authorization Bypass
6.8
CVE-2021-39203
Sep 9, 2021
Researcher: Steve Henty
10WebSocial <= 1.1.26 - Authenticated (Admin+) SQL Injection
6.8
CVE ID Unknown
Sep 11, 2020
Researcher: Vu Tien Hoa
WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting
6.8
CVE-2020-4047
Jun 10, 2020
Researcher: Luigi Gubello
Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import
6.6
CVE-2024-7620
Sep 6, 2024
Researcher: Luk6785
Timetable and Event Schedule <= 2.4.13 - Authenticated (Admin+) PHP Object Injection
6.6
CVE-2024-39630
Jul 22, 2024
Researcher: Nguyễn Phương Bắc
MelaPress Login Security <= 1.3.0 - Authenticated (Admin+) Remote File Inclusion
6.6
CVE-2024-35650
Jun 3, 2024
Researcher: YC_Infosec
Title CVE ID CVSS Researchers Date
Quttera Web Malware Scanner <= 3.4.1.48 - Authenticated (Administrator+) Directory Traversal via ShowFile CVE-2023-6222 6.8 Dmitrii Ignatyev November 21, 2023
Post to CSV by BestWebSoft <= 1.3.8 - Authenticated (Author+) CSV Injection CVE-2022-3393 6.8 Francesco Carlucci October 3, 2022
Download Monitor <= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download CVE-2022-2981 6.8 Raad Haddad September 19, 2022
Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal 6.8 Sybre Waaijer September 19, 2022
Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal CVE-2022-2554 6.8 Raad Haddad September 14, 2022
Database Management tool – Adminer <= 1.1.5 - Information Exposure 6.8 August 16, 2022
VR Calendar <= 2.4.0 - Authenticated (Administrator+) Local File Inclusion 6.8 WPScanTeam July 28, 2022
Music Player for WooCommerce <= 1.0.172 - Authenticated (Admin+) Stored Cross-Site Scripting 6.8 June 30, 2022
CaPa Protect <= 0.5.8.2 - Cross-Site Request Forgery to Settings Update CVE-2022-1832 6.8 Daniel Ruf May 30, 2022
Popup Box <= 2.1.2 - Authenticated Local File Inclusion CVE-2022-29445 6.8 0xB9 May 17, 2022
Counter Box <= 1.1.1 - Authenticated Local File Inclusion CVE-2022-29446 6.8 0xB9 May 16, 2022
Hover Effects – easily create any hover effect <= 2.1 - Authenticated Local File Inclusion CVE-2022-29447 6.8 0xB9 May 16, 2022
iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip CVE-2022-0246 6.8 Ceylan Bozogullarindan March 16, 2022
Download Monitor <= 4.4.6 - Authenticated (Admin+) Arbitrary File Download CVE-2021-31567 6.8 RE-ALTER October 29, 2021
WordPress Core 5.8 beta - Block Editor Authorization Bypass CVE-2021-39203 6.8 Steve Henty September 9, 2021
10WebSocial <= 1.1.26 - Authenticated (Admin+) SQL Injection 6.8 Vu Tien Hoa September 11, 2020
WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting CVE-2020-4047 6.8 Luigi Gubello June 10, 2020
Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import CVE-2024-7620 6.6 Luk6785 September 6, 2024
Timetable and Event Schedule <= 2.4.13 - Authenticated (Admin+) PHP Object Injection CVE-2024-39630 6.6 Nguyễn Phương Bắc July 22, 2024
MelaPress Login Security <= 1.3.0 - Authenticated (Admin+) Remote File Inclusion CVE-2024-35650 6.6 YC_Infosec June 3, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 31, 2024
Vulns
1 Francesco Carlucci 30
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Peter Thaleikis 7
8 Marco Wotschka 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 zer0gh0st 4
13 LVT-tholv2k 3
14 Robert DeVore 3
15 Le Ngoc Anh 3
16 rezaduty 3
17 Rafie Muhammad 2
18 Tonn 2
19 Jorge Diaz (ddiax) 2
20 Michelle Porter 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation