WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Cab fare calculator <= 1.0.3 - Unauthenticated Local File Inclusion
6.5
CVE-2022-1391
Apr 20, 2022
Researcher: splint3r7
Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read
6.5
CVE-2022-1390
Apr 20, 2022
Researcher: Hassan Khan Yusufzai
Ubigeo de Perú para Woocommerce y WordPress <= 3.6.3 - Unauthenticated SQL Injection
6.5
CVE-2022-0814
Apr 18, 2022
Researcher: cydave
Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQL Injection
6.5
CVE-2022-0783
Apr 13, 2022
Researcher: cydave
Sitemap by click5 <= 1.0.35 - Unauthenticated Arbitrary Options Update
6.5
CVE-2022-0952
Apr 13, 2022
Researcher: cydave
WP Video Gallery <= 1.7.1 - SQL Injection
6.5
CVE-2022-0826
Apr 13, 2022
Researcher: cydave
RSFirewall! <= 1.1.24 - IP Address Spoofing
6.5
CVE-2021-4226
Apr 13, 2022
Researcher: Daniel Ruf
Tipsacarrier < 1.5.0.5 - Missing Authorization to Order Disclosure
6.5
CVE-2021-25002
Apr 13, 2022
Researcher: José Aguilera
Order Listener for WooCommerce – Play Sounds Instantly on New Orders <= 3.2.1 - Unauthenticated SQL Injection
6.5
CVE-2022-0948
Apr 12, 2022
Researcher: cydave
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure
6.5
CVE ID Unknown
Apr 10, 2022
Researchers:
Quick Adsense < 2.8.2 - Missing Authorization
6.5
CVE ID Unknown
Apr 2, 2022
Researcher: Jan w Oleju
Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure
6.5
CVE-2022-23183
Mar 30, 2022
Researcher: Keitaro Yamazaki
Curtain < 1.0.2 - Unauthenticated Maintenance Mode Enabled/Disable
6.5
CVE ID Unknown
Mar 30, 2022
Researchers:
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization
6.5
CVE-2022-0363
Mar 29, 2022
Researcher: Krzysztof Zając
Shopping Cart & eCommerce Store <= 5.2.4 - Cross-Site Request Forgery to Settings Update
6.5
CVE ID Unknown
Mar 28, 2022
Researcher: WPScanTeam
Tatsu <= 3.3.12 - Unauthenticated Remote Code Execution
6.5
CVE-2021-25094
Mar 28, 2022
Researcher: Vincent MICHEL
Export All URLs <= 4.2 - Cross-Site Request Forgery to Sensitive Data Export
6.5
CVE-2022-0914
Mar 21, 2022
Researcher: Asif Nawaz Minhas
Material Design for Contact Form 7 <= 2.6.4 - Missing Authorization to Arbitrary Settings Update
6.5
CVE-2022-0404
Mar 11, 2022
Researcher: Krzysztof Zając
FormBuilder <= 1.08 - Cross-Site Request Forgery
6.5
CVE-2022-0830
Mar 8, 2022
Researcher: Chiragh Arora
WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal
6.5
CVE-2021-24962
Mar 1, 2022
Researcher: apple502j
Title CVE ID CVSS Researchers Date
Cab fare calculator <= 1.0.3 - Unauthenticated Local File Inclusion CVE-2022-1391 6.5 splint3r7 April 20, 2022
Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read CVE-2022-1390 6.5 Hassan Khan Yusufzai April 20, 2022
Ubigeo de Perú para Woocommerce y WordPress <= 3.6.3 - Unauthenticated SQL Injection CVE-2022-0814 6.5 cydave April 18, 2022
Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQL Injection CVE-2022-0783 6.5 cydave April 13, 2022
Sitemap by click5 <= 1.0.35 - Unauthenticated Arbitrary Options Update CVE-2022-0952 6.5 cydave April 13, 2022
WP Video Gallery <= 1.7.1 - SQL Injection CVE-2022-0826 6.5 cydave April 13, 2022
RSFirewall! <= 1.1.24 - IP Address Spoofing CVE-2021-4226 6.5 Daniel Ruf April 13, 2022
Tipsacarrier < 1.5.0.5 - Missing Authorization to Order Disclosure CVE-2021-25002 6.5 José Aguilera April 13, 2022
Order Listener for WooCommerce – Play Sounds Instantly on New Orders <= 3.2.1 - Unauthenticated SQL Injection CVE-2022-0948 6.5 cydave April 12, 2022
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure 6.5 April 10, 2022
Quick Adsense < 2.8.2 - Missing Authorization 6.5 Jan w Oleju April 2, 2022
Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure CVE-2022-23183 6.5 Keitaro Yamazaki March 30, 2022
Curtain < 1.0.2 - Unauthenticated Maintenance Mode Enabled/Disable 6.5 March 30, 2022
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization CVE-2022-0363 6.5 Krzysztof Zając March 29, 2022
Shopping Cart & eCommerce Store <= 5.2.4 - Cross-Site Request Forgery to Settings Update 6.5 WPScanTeam March 28, 2022
Tatsu <= 3.3.12 - Unauthenticated Remote Code Execution CVE-2021-25094 6.5 Vincent MICHEL March 28, 2022
Export All URLs <= 4.2 - Cross-Site Request Forgery to Sensitive Data Export CVE-2022-0914 6.5 Asif Nawaz Minhas March 21, 2022
Material Design for Contact Form 7 <= 2.6.4 - Missing Authorization to Arbitrary Settings Update CVE-2022-0404 6.5 Krzysztof Zając March 11, 2022
FormBuilder <= 1.08 - Cross-Site Request Forgery CVE-2022-0830 6.5 Chiragh Arora March 8, 2022
WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal CVE-2021-24962 6.5 apple502j March 1, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 29, 2024
Vulns
1 Francesco Carlucci 33
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Marco Wotschka 7
8 Peter Thaleikis 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 rezaduty 5
13 zer0gh0st 4
14 LVT-tholv2k 3
15 Robert DeVore 3
16 Le Ngoc Anh 3
17 RyotaK 2
18 Jorge Diaz (ddiax) 2
19 Tonn 2
20 Ankit Patel 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation