WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
My Tickets <= 1.9.10 - Cross-Site Request Forgery
6.5
CVE-2022-47440
Jan 4, 2023
Researcher: rezaduty
WP Limit Login Attempts <= 2.6.4 - IP Spoofing to Protection Mechanism Bypass
6.5
CVE-2022-4303
Dec 27, 2022
Researcher: Daniel Ruf
FluentAuth <= 1.0.1 - IP Spoofing to Protection Mechanism Bypass
6.5
CVE-2022-4746
Dec 27, 2022
Researcher: Daniel Ruf
Mongoose Page Plugin <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.5
CVE-2022-4675
Dec 27, 2022
Researcher: István Márton
ActiveCampaign for WooCommerce <= 1.9.7 - Cross-Site Request Forgery
6.5
CVE-2022-3923
Dec 20, 2022
Researcher: István Márton
ActiveCampaign for WooCommerce <= 1.9.6 - Missing Authorization to Error Log Deletion
6.5
CVE-2022-3923
Dec 16, 2022
Researcher: István Márton
Royal Elementor Addons <=1.3.55 - Missing Authorization to Subscriber+ Arbitrary Post Creation
6.5
CVE-2022-4103
Dec 15, 2022
Researcher: Krzysztof Zając
demon image annotation <= 5.0 - Improper Input Restriction Validation
6.5
CVE-2022-4171
Dec 11, 2022
Researcher: Ori Gabriel
BookingPress <= 1.0.30 - Unauthenticated Insecure Direct Object Reference
6.5
CVE-2022-4340
Dec 7, 2022
Researcher: Hussien Misbah
Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read
6.5
CVE-2022-4236
Dec 5, 2022
Researcher: WPScanTeam
Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization
6.5
CVE-2022-4237
Dec 5, 2022
Researcher: WPScanTeam
ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference
6.5
CVE ID Unknown
Dec 5, 2022
Researcher: Chris Grello
Attorney <= 3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
6.5
CVE-2022-45832
Dec 1, 2022
Researcher: Dave Jong
Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Arbitrary File Deletion
6.5
CVE-2022-45829
Nov 30, 2022
Researcher: TomS
WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation
6.5
CVE-2022-4555
Nov 28, 2022
Researcher: Chloe Chamberland
Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization
6.5
CVE-2022-4169
Nov 28, 2022
Researcher: Florent BESNARD
Popup Manager <= 1.6.6 - Missing Authorization to Arbitrary Popup Deletion
6.5
CVE-2022-4124
Nov 28, 2022
Researcher: István Márton
Pie Register <= 3.8.1.2 - Missing Authorization to Arbitrary User Deletion
6.5
CVE-2022-4024
Nov 28, 2022
Researcher: cydave
Better Click To Tweet <= 5.10.3 - Missing Authorization
6.5
CVE-2022-45839
Nov 28, 2022
Researcher: Tien Nguyen Ahn
WP-FormAssembly <= 2.0.5 - Authenticated (Contributor+) Arbitrary File Read
6.5
CVE-2022-45852
Nov 23, 2022
Researcher: Tien Nguyen Ahn
Title CVE ID CVSS Researchers Date
My Tickets <= 1.9.10 - Cross-Site Request Forgery CVE-2022-47440 6.5 rezaduty January 4, 2023
WP Limit Login Attempts <= 2.6.4 - IP Spoofing to Protection Mechanism Bypass CVE-2022-4303 6.5 Daniel Ruf December 27, 2022
FluentAuth <= 1.0.1 - IP Spoofing to Protection Mechanism Bypass CVE-2022-4746 6.5 Daniel Ruf December 27, 2022
Mongoose Page Plugin <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2022-4675 6.5 István Márton December 27, 2022
ActiveCampaign for WooCommerce <= 1.9.7 - Cross-Site Request Forgery CVE-2022-3923 6.5 István Márton December 20, 2022
ActiveCampaign for WooCommerce <= 1.9.6 - Missing Authorization to Error Log Deletion CVE-2022-3923 6.5 István Márton December 16, 2022
Royal Elementor Addons <=1.3.55 - Missing Authorization to Subscriber+ Arbitrary Post Creation CVE-2022-4103 6.5 Krzysztof Zając December 15, 2022
demon image annotation <= 5.0 - Improper Input Restriction Validation CVE-2022-4171 6.5 Ori Gabriel December 11, 2022
BookingPress <= 1.0.30 - Unauthenticated Insecure Direct Object Reference CVE-2022-4340 6.5 Hussien Misbah December 7, 2022
Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read CVE-2022-4236 6.5 WPScanTeam December 5, 2022
Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization CVE-2022-4237 6.5 WPScanTeam December 5, 2022
ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference 6.5 Chris Grello December 5, 2022
Attorney <= 3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion CVE-2022-45832 6.5 Dave Jong December 1, 2022
Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Arbitrary File Deletion CVE-2022-45829 6.5 TomS November 30, 2022
WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation CVE-2022-4555 6.5 Chloe Chamberland November 28, 2022
Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization CVE-2022-4169 6.5 Florent BESNARD November 28, 2022
Popup Manager <= 1.6.6 - Missing Authorization to Arbitrary Popup Deletion CVE-2022-4124 6.5 István Márton November 28, 2022
Pie Register <= 3.8.1.2 - Missing Authorization to Arbitrary User Deletion CVE-2022-4024 6.5 cydave November 28, 2022
Better Click To Tweet <= 5.10.3 - Missing Authorization CVE-2022-45839 6.5 Tien Nguyen Ahn November 28, 2022
WP-FormAssembly <= 2.0.5 - Authenticated (Contributor+) Arbitrary File Read CVE-2022-45852 6.5 Tien Nguyen Ahn November 23, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 29, 2024
Vulns
1 Francesco Carlucci 33
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Marco Wotschka 7
8 Peter Thaleikis 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 rezaduty 5
13 zer0gh0st 4
14 LVT-tholv2k 3
15 Robert DeVore 3
16 Le Ngoc Anh 3
17 RyotaK 2
18 Jorge Diaz (ddiax) 2
19 Tonn 2
20 Ankit Patel 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation