WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
SMSA Shipping for WooCommerce <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Download
6.5
CVE-2022-4107
Nov 22, 2022
Researcher: WPScanTeam
All-In-One Security (AIOS) – Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass
6.5
CVE-2022-4097
Nov 21, 2022
Researcher: Daniel Ruf
Anti Hacker <= 4.19 - Missing Authorization to Arbitrary Plugin Install
6.5
CVE-2022-3880
Nov 21, 2022
Researcher: István Márton
Car Dealer <= 3.04 - Missing Authorization to Arbitrary Plugin Installation
6.5
CVE-2022-3879
Nov 18, 2022
Researcher: István Márton
Memory Usage <= 2.45 - Missing Authorization to Arbitrary Plugin Installation
6.5
CVE-2022-3882
Nov 18, 2022
Researcher: István Márton
WP Tools <= 3.42 - Missing Authorization to Select Plugin Installation
6.5
CVE-2022-3881
Nov 18, 2022
Researcher: István Márton
StopBadBots <= 7.23 - Missing Authorization to Arbitrary Plugin Installation
6.5
CVE-2022-3883
Nov 18, 2022
Researcher: István Márton
Add Multiple Marker <= 1.2 - Missing Authorization Checks to Settings Update
6.5
CVE-2022-45081
Nov 11, 2022
Researcher: ptsfence
001 Prime Strategy Translate Accelerator <= 1.1.1 - Missing Authorization
6.5
CVE ID Unknown
Nov 3, 2022
Researchers:
Download Plugin <= 1.6.2 - Missing Authorization and Sensitive Information Exposure
6.5
CVE-2021-25059
Nov 2, 2022
Researcher: apple502j
Permalink Manager Lite <= 2.2.20 - Missing Authorization
6.5
CVE-2022-41781
Nov 1, 2022
Researcher: Nguyen Anh Tien
WP-Polls <= 2.75.6 - IP Validation Bypass
6.5
CVE-2022-1581
Oct 31, 2022
Researcher: Daniel Ruf
DeepL Pro API Translation <= 1.7.4 - Sensitive Information Disclosure
6.5
CVE-2022-3691
Oct 31, 2022
Researcher: Raad Haddad
Booster (<= 5.6.6) and Booster Plus (<= 5.6.4) for WooCommerce - Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download
6.5
CVE-2022-3762
Oct 27, 2022
Researcher: WPScanTeam
Phone Orders for WooCommerce <= 3.7.1 - Missing Authorization
6.5
CVE-2022-41655
Oct 24, 2022
Researcher: István Márton
WIP Custom Login <= 1.2.7 - Missing Authorization
6.5
CVE-2022-42884
Oct 24, 2022
Researcher: István Márton
Traffic Manager <= 1.4.5 - Missing Authorization
6.5
CVE-2022-41695
Oct 24, 2022
Researcher: István Márton
Webmaster Tools Verification <= 1.2 - Missing Authorization to Arbitrary Plugin Deactivation
6.5
CVE-2022-3538
Oct 19, 2022
Researcher: Daniel Ruf
Mihdan: Public Post Preview <= 1.9.9 - Missing Authorization
6.5
CVE ID Unknown
Oct 17, 2022
Researchers:
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal
6.5
CVE-2022-2711
Oct 17, 2022
Researcher: lucy
Title CVE ID CVSS Researchers Date
SMSA Shipping for WooCommerce <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Download CVE-2022-4107 6.5 WPScanTeam November 22, 2022
All-In-One Security (AIOS) – Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass CVE-2022-4097 6.5 Daniel Ruf November 21, 2022
Anti Hacker <= 4.19 - Missing Authorization to Arbitrary Plugin Install CVE-2022-3880 6.5 István Márton November 21, 2022
Car Dealer <= 3.04 - Missing Authorization to Arbitrary Plugin Installation CVE-2022-3879 6.5 István Márton November 18, 2022
Memory Usage <= 2.45 - Missing Authorization to Arbitrary Plugin Installation CVE-2022-3882 6.5 István Márton November 18, 2022
WP Tools <= 3.42 - Missing Authorization to Select Plugin Installation CVE-2022-3881 6.5 István Márton November 18, 2022
StopBadBots <= 7.23 - Missing Authorization to Arbitrary Plugin Installation CVE-2022-3883 6.5 István Márton November 18, 2022
Add Multiple Marker <= 1.2 - Missing Authorization Checks to Settings Update CVE-2022-45081 6.5 ptsfence November 11, 2022
001 Prime Strategy Translate Accelerator <= 1.1.1 - Missing Authorization 6.5 November 3, 2022
Download Plugin <= 1.6.2 - Missing Authorization and Sensitive Information Exposure CVE-2021-25059 6.5 apple502j November 2, 2022
Permalink Manager Lite <= 2.2.20 - Missing Authorization CVE-2022-41781 6.5 Nguyen Anh Tien November 1, 2022
WP-Polls <= 2.75.6 - IP Validation Bypass CVE-2022-1581 6.5 Daniel Ruf October 31, 2022
DeepL Pro API Translation <= 1.7.4 - Sensitive Information Disclosure CVE-2022-3691 6.5 Raad Haddad October 31, 2022
Booster (<= 5.6.6) and Booster Plus (<= 5.6.4) for WooCommerce - Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download CVE-2022-3762 6.5 WPScanTeam October 27, 2022
Phone Orders for WooCommerce <= 3.7.1 - Missing Authorization CVE-2022-41655 6.5 István Márton October 24, 2022
WIP Custom Login <= 1.2.7 - Missing Authorization CVE-2022-42884 6.5 István Márton October 24, 2022
Traffic Manager <= 1.4.5 - Missing Authorization CVE-2022-41695 6.5 István Márton October 24, 2022
Webmaster Tools Verification <= 1.2 - Missing Authorization to Arbitrary Plugin Deactivation CVE-2022-3538 6.5 Daniel Ruf October 19, 2022
Mihdan: Public Post Preview <= 1.9.9 - Missing Authorization 6.5 October 17, 2022
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal CVE-2022-2711 6.5 lucy October 17, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 29, 2024
Vulns
1 Francesco Carlucci 33
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Marco Wotschka 7
8 Peter Thaleikis 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 rezaduty 5
13 zer0gh0st 4
14 LVT-tholv2k 3
15 Robert DeVore 3
16 Le Ngoc Anh 3
17 RyotaK 2
18 Jorge Diaz (ddiax) 2
19 Tonn 2
20 Ankit Patel 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation