WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Booking Calendar <= 9.4.2 - Authenticated (Admin+) SQL Injection
6.6
CVE-2023-23991
Jan 20, 2023
Researcher: Rafshanzani Suhada
Interactive Polish Map <= 1.2 - Authenticated (Admi+) Stored Cross-Site Scripting
6.6
CVE-2023-23821
Jan 19, 2023
Researcher: Rio Darmawan
Revive Old Posts <= 9.0.10 - Authenticated (Admin+) PHP Object Injection
6.6
CVE-2022-4680
Jan 4, 2023
Researcher: Nguyen Huu Do
ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection
6.6
CVE-2022-45083
Dec 14, 2022
Researcher: Thura Moe Myint (mgthuramoemyint)
Contest Gallery Pro <= 19.1.4.1 - Authenticated (Administrator+) SQL Injection via wp_user_id
6.6
CVE-2022-4154
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Starter Templates by Kadence WP <= 1.2.16 - Authenticated (Admin+) PHP Object Injection
6.6
CVE-2022-3679
Dec 1, 2022
Researcher: Nguyen Pham Viet Nam
Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery
6.6
CVE-2022-2352
Sep 5, 2022
Researcher: Raad Haddad
All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts
6.6
CVE-2022-1476
Apr 28, 2022
Researcher: haidv35
WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection
6.6
CVE-2022-21663
Jan 6, 2022
Researcher: Simon Scannell
Absolutely Glamorous Custom Admin <= 6.8 - Authenticated Stored Cross-Site Scripting
6.6
CVE-2021-36823
Sep 23, 2021
Researcher: Jorgson
NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization
6.6
CVE ID Unknown
May 30, 2021
Researcher: Chloe Chamberland
Sendit WP Newsletter <= 2.5.1 - Authenticated (Admin+) SQL Injection
6.6
CVE-2021-24345
May 27, 2021
Researcher: Shreya Pohekar
User Rights Access Manager <= 1.0.3 - Missing Authorization
6.6
CVE ID Unknown
Apr 15, 2021
Researchers:
Computer Repair Shop < 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
6.6
CVE ID Unknown
Jan 13, 2020
Researcher: Jeroen Mulder
Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution
6.6
CVE-2018-19370
Nov 6, 2018
Researchers:
WooCommerce <= 3.4.4 - Authenticated PHP Object Injection
6.6
CVE ID Unknown
Aug 29, 2018
Researchers:
WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload
6.6
CVE-2018-14028
Aug 4, 2018
Researcher: Vinicius Marangoni
SecureMoz Security Audit <= 1.0.5 - PHP Object Injection
6.6
CVE-2015-6828
Sep 5, 2015
Researcher: Scott Arciszewski
Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.3 - Missing Authorization to Sensitive Information Exposure
6.5
CVE-2024-6332
Sep 4, 2024
Researcher: Nadim Zubidat
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
6.5
CVE-2024-8106
Sep 3, 2024
Researcher: Marco Wotschka
Title CVE ID CVSS Researchers Date
Booking Calendar <= 9.4.2 - Authenticated (Admin+) SQL Injection CVE-2023-23991 6.6 Rafshanzani Suhada January 20, 2023
Interactive Polish Map <= 1.2 - Authenticated (Admi+) Stored Cross-Site Scripting CVE-2023-23821 6.6 Rio Darmawan January 19, 2023
Revive Old Posts <= 9.0.10 - Authenticated (Admin+) PHP Object Injection CVE-2022-4680 6.6 Nguyen Huu Do January 4, 2023
ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection CVE-2022-45083 6.6 Thura Moe Myint (mgthuramoemyint) December 14, 2022
Contest Gallery Pro <= 19.1.4.1 - Authenticated (Administrator+) SQL Injection via wp_user_id CVE-2022-4154 6.6 Kunal Sharma, Daniel Krohmer December 5, 2022
Starter Templates by Kadence WP <= 1.2.16 - Authenticated (Admin+) PHP Object Injection CVE-2022-3679 6.6 Nguyen Pham Viet Nam December 1, 2022
Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery CVE-2022-2352 6.6 Raad Haddad September 5, 2022
All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts CVE-2022-1476 6.6 haidv35 April 28, 2022
WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection CVE-2022-21663 6.6 Simon Scannell January 6, 2022
Absolutely Glamorous Custom Admin <= 6.8 - Authenticated Stored Cross-Site Scripting CVE-2021-36823 6.6 Jorgson September 23, 2021
NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization 6.6 Chloe Chamberland May 30, 2021
Sendit WP Newsletter <= 2.5.1 - Authenticated (Admin+) SQL Injection CVE-2021-24345 6.6 Shreya Pohekar May 27, 2021
User Rights Access Manager <= 1.0.3 - Missing Authorization 6.6 April 15, 2021
Computer Repair Shop < 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting 6.6 Jeroen Mulder January 13, 2020
Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution CVE-2018-19370 6.6 November 6, 2018
WooCommerce <= 3.4.4 - Authenticated PHP Object Injection 6.6 August 29, 2018
WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload CVE-2018-14028 6.6 Vinicius Marangoni August 4, 2018
SecureMoz Security Audit <= 1.0.5 - PHP Object Injection CVE-2015-6828 6.6 Scott Arciszewski September 5, 2015
Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.3 - Missing Authorization to Sensitive Information Exposure CVE-2024-6332 6.5 Nadim Zubidat September 4, 2024
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure CVE-2024-8106 6.5 Marco Wotschka September 3, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 30, 2024
Vulns
1 Francesco Carlucci 30
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 stealthcopter 10
6 Krzysztof Zając 10
7 Peter Thaleikis 7
8 Marco Wotschka 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 zer0gh0st 4
13 LVT-tholv2k 3
14 Robert DeVore 3
15 Le Ngoc Anh 3
16 rezaduty 3
17 Tonn 2
18 Tieu Pham Trong Nhan 2
19 Michelle Porter 2
20 Connor Billings 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation