WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product
6.5
CVE-2023-2892
May 27, 2023
Researcher: Alex Thomas
WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product
6.5
CVE-2023-2891
May 27, 2023
Researcher: Alex Thomas
BEAR <= 1.1.3.1 - Cross-Site Request Forgery via Multiple Functions
6.5
CVE-2023-33314
May 22, 2023
Researcher: Nguyen Xuan Chien
WIP Custom Login <= 1.2.9 - Cross-Site Request Forgery via save_option
6.5
CVE-2023-33313
May 22, 2023
Researcher: LEE SE HYOUNG
WordPress Core < 6.2.1 - Shortcode Execution in User Generated Content
6.5
CVE ID Unknown
May 19, 2023
Researcher: Liam Gladdy
WordPress Core < 6.2.2 - Shortcode Execution in User Generated Content
6.5
CVE ID Unknown
May 19, 2023
Researcher: Liam Gladdy
Predictive Search <= 1.2.2 - Missing Authorization
6.5
CVE ID Unknown
May 15, 2023
Researchers:
Predictive Search <= 1.2.2 - Missing Authorization
6.5
CVE ID Unknown
May 15, 2023
Researchers:
Predictive Search <= 1.2.2 - Missing Authorization
6.5
CVE ID Unknown
May 15, 2023
Researchers:
Portfolio Gallery – Responsive Image Gallery <= 1.4.5 - Missing Authorization to Arbitrary Gallery Deletion
6.5
CVE-2023-32585
May 11, 2023
Researcher: István Márton
YITH WooCommerce Gift Cards Premium <= 3.23.1 - Missing Authorization
6.5
CVE-2022-44633
May 10, 2023
Researcher: Dave Jong
Pro Mime Types - Manage file media types <= 1.0.7 - Cross-Site Request Forgery via pmt_settings_section_callback_tab_1
6.5
CVE ID Unknown
May 9, 2023
Researcher: Nguyen Xuan Chien
Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass
6.5
CVE-2022-4537
May 8, 2023
Researcher: rezaduty
Points and Rewards for WooCommerce <= 1.5.0 - Missing Authorization
6.5
CVE-2023-27608
May 5, 2023
Researcher: Dave Jong
Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization
6.5
CVE-2023-1843
May 4, 2023
Researcher: Marco Wotschka
WP Fastest Cache <= 1.1.4 - Authenticated(Administrator+) Blind Server Side Request Forgery via check_url
6.5
CVE-2023-1938
May 2, 2023
Researcher: Erwan LR
WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action
6.5
CVE-2023-2280
May 2, 2023
Researchers: István Márton, Ram
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.0 - Missing Authorization via vg_display_data shortcode
6.5
CVE-2023-31073
Apr 24, 2023
Researcher: Yuki Haruma
Ebook Store <= 5.775 - Missing Authorization via ebook_store_export_orders
6.5
CVE-2023-22701
Apr 19, 2023
Researcher: yuyudhn
ReviewX <= 1.6.7 - Unauthenticated CSV Injection
6.5
CVE-2022-46809
Apr 13, 2023
Researcher: Mika
Title CVE ID CVSS Researchers Date
WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product CVE-2023-2892 6.5 Alex Thomas May 27, 2023
WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product CVE-2023-2891 6.5 Alex Thomas May 27, 2023
BEAR <= 1.1.3.1 - Cross-Site Request Forgery via Multiple Functions CVE-2023-33314 6.5 Nguyen Xuan Chien May 22, 2023
WIP Custom Login <= 1.2.9 - Cross-Site Request Forgery via save_option CVE-2023-33313 6.5 LEE SE HYOUNG May 22, 2023
WordPress Core < 6.2.1 - Shortcode Execution in User Generated Content 6.5 Liam Gladdy May 19, 2023
WordPress Core < 6.2.2 - Shortcode Execution in User Generated Content 6.5 Liam Gladdy May 19, 2023
Predictive Search <= 1.2.2 - Missing Authorization 6.5 May 15, 2023
Predictive Search <= 1.2.2 - Missing Authorization 6.5 May 15, 2023
Predictive Search <= 1.2.2 - Missing Authorization 6.5 May 15, 2023
Portfolio Gallery – Responsive Image Gallery <= 1.4.5 - Missing Authorization to Arbitrary Gallery Deletion CVE-2023-32585 6.5 István Márton May 11, 2023
YITH WooCommerce Gift Cards Premium <= 3.23.1 - Missing Authorization CVE-2022-44633 6.5 Dave Jong May 10, 2023
Pro Mime Types - Manage file media types <= 1.0.7 - Cross-Site Request Forgery via pmt_settings_section_callback_tab_1 6.5 Nguyen Xuan Chien May 9, 2023
Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass CVE-2022-4537 6.5 rezaduty May 8, 2023
Points and Rewards for WooCommerce <= 1.5.0 - Missing Authorization CVE-2023-27608 6.5 Dave Jong May 5, 2023
Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization CVE-2023-1843 6.5 Marco Wotschka May 4, 2023
WP Fastest Cache <= 1.1.4 - Authenticated(Administrator+) Blind Server Side Request Forgery via check_url CVE-2023-1938 6.5 Erwan LR May 2, 2023
WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action CVE-2023-2280 6.5 István Márton, Ram May 2, 2023
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.0 - Missing Authorization via vg_display_data shortcode CVE-2023-31073 6.5 Yuki Haruma April 24, 2023
Ebook Store <= 5.775 - Missing Authorization via ebook_store_export_orders CVE-2023-22701 6.5 yuyudhn April 19, 2023
ReviewX <= 1.6.7 - Unauthenticated CSV Injection CVE-2022-46809 6.5 Mika April 13, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 29, 2024
Vulns
1 Francesco Carlucci 33
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Marco Wotschka 7
8 Peter Thaleikis 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 rezaduty 5
13 zer0gh0st 4
14 LVT-tholv2k 3
15 Robert DeVore 3
16 Le Ngoc Anh 3
17 RyotaK 2
18 Jorge Diaz (ddiax) 2
19 Tonn 2
20 Ankit Patel 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation