WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-6446
Dec 5, 2023
Researcher: emad
Email Subscription Popup <= 1.2.18 - Reflected Cross-Site Scripting
6.1
CVE-2023-6527
Dec 5, 2023
Researcher: 0x9567b
Flexible Woocommerce Checkout Field Editor <= 2.0.1 - Missing Authorization
5.3
CVE-2023-49817
Dec 5, 2023
Researcher: Abdi Pranata
WP Photo Album Plus <= 8.5.02.005 - Cross-Site Scripting
6.1
CVE-2023-49813
Dec 5, 2023
Researcher: Kyle Sanchez
Genesis Simple Love <= 2.0 - Unauthenticated PHP Object Injection
9.8
CVE-2023-49772
Dec 5, 2023
Researcher: Rafie Muhammad
Ultimate Dashboard <= 3.7.10 - Login Page Disclosure on Multi-site
5.3
CVE-2023-49822
Dec 5, 2023
Researcher: Naveen Muthusamy
Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection
8.8
CVE-2023-49825
Dec 5, 2023
Researcher: Rafie Muhammad
Symbiostock Lite <= 6.0.0 - Authenticated (Shop Manager+) Arbitrary File Upload
7.2
CVE-2023-49814
Dec 5, 2023
Researcher: Rafie Muhammad
WP Photo Album Plus <= 8.5.02.005 - Insecure Direct Object Reference
5.3
CVE-2023-49812
Dec 5, 2023
Researcher: Kyle Sanchez
Soledad <= 8.4.1 - Unauthenticated PHP Object Injection
9.8
CVE-2023-49826
Dec 5, 2023
Researcher: Rafie Muhammad
Smart External Link Click Monitor [Link Log] <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-49770
Dec 5, 2023
Researcher: Mika
Smart External Link Click Monitor [Link Log] <= 5.0.2 - Reflected Cross-Site Scripting
6.1
CVE-2023-49771
Dec 5, 2023
Researcher: Mika
Sayfa Sayaç <= 2.6 - Unauthenticated SQL Injection
9.8
CVE-2023-49776
Dec 5, 2023
Researcher: Rafie Muhammad
Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-49829
Dec 5, 2023
Researcher: emad
Structured Content <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-49820
Dec 5, 2023
Researcher: LVT-tholv2k
Post Duplicator <= 2.31 - Missing Authorization via mtphr_duplicate_post
4.3
CVE-2023-49835
Dec 5, 2023
Researcher: Huynh Tien Si
1 click disable all <= 1.0.1 - Cross-Site Request Forgery
4.3
CVE-2024-21749
Dec 5, 2023
Researcher: Veerla Saikumar
Soledad <= 8.4.1 - Reflected Cross-Site Scripting
6.1
CVE-2023-49827
Dec 5, 2023
Researcher: Rafie Muhammad
Bold Page Builder <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-49823
Dec 5, 2023
Researcher: Ngô Thiên An (ancorn_)
BCorp Shortcodes <= 0.23 - Unauthenticated PHP Object Injection
9.8
CVE-2023-49773
Dec 5, 2023
Researcher: Rafie Muhammad
Title CVE ID CVSS Researchers Date
Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-6446 4.4 emad December 5, 2023
Email Subscription Popup <= 1.2.18 - Reflected Cross-Site Scripting CVE-2023-6527 6.1 0x9567b December 5, 2023
Flexible Woocommerce Checkout Field Editor <= 2.0.1 - Missing Authorization CVE-2023-49817 5.3 Abdi Pranata December 5, 2023
WP Photo Album Plus <= 8.5.02.005 - Cross-Site Scripting CVE-2023-49813 6.1 Kyle Sanchez December 5, 2023
Genesis Simple Love <= 2.0 - Unauthenticated PHP Object Injection CVE-2023-49772 9.8 Rafie Muhammad December 5, 2023
Ultimate Dashboard <= 3.7.10 - Login Page Disclosure on Multi-site CVE-2023-49822 5.3 Naveen Muthusamy December 5, 2023
Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection CVE-2023-49825 8.8 Rafie Muhammad December 5, 2023
Symbiostock Lite <= 6.0.0 - Authenticated (Shop Manager+) Arbitrary File Upload CVE-2023-49814 7.2 Rafie Muhammad December 5, 2023
WP Photo Album Plus <= 8.5.02.005 - Insecure Direct Object Reference CVE-2023-49812 5.3 Kyle Sanchez December 5, 2023
Soledad <= 8.4.1 - Unauthenticated PHP Object Injection CVE-2023-49826 9.8 Rafie Muhammad December 5, 2023
Smart External Link Click Monitor [Link Log] <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-49770 4.4 Mika December 5, 2023
Smart External Link Click Monitor [Link Log] <= 5.0.2 - Reflected Cross-Site Scripting CVE-2023-49771 6.1 Mika December 5, 2023
Sayfa Sayaç <= 2.6 - Unauthenticated SQL Injection CVE-2023-49776 9.8 Rafie Muhammad December 5, 2023
Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-49829 4.4 emad December 5, 2023
Structured Content <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-49820 6.4 LVT-tholv2k December 5, 2023
Post Duplicator <= 2.31 - Missing Authorization via mtphr_duplicate_post CVE-2023-49835 4.3 Huynh Tien Si December 5, 2023
1 click disable all <= 1.0.1 - Cross-Site Request Forgery CVE-2024-21749 4.3 Veerla Saikumar December 5, 2023
Soledad <= 8.4.1 - Reflected Cross-Site Scripting CVE-2023-49827 6.1 Rafie Muhammad December 5, 2023
Bold Page Builder <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-49823 6.4 Ngô Thiên An (ancorn_) December 5, 2023
BCorp Shortcodes <= 0.23 - Unauthenticated PHP Object Injection CVE-2023-49773 9.8 Rafie Muhammad December 5, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 29, 2024
Vulns
1 Francesco Carlucci 33
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Marco Wotschka 7
8 Peter Thaleikis 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 rezaduty 5
13 zer0gh0st 4
14 LVT-tholv2k 3
15 Robert DeVore 3
16 Le Ngoc Anh 3
17 RyotaK 2
18 Jorge Diaz (ddiax) 2
19 Tonn 2
20 Ankit Patel 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation