🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-7144

Aug 15, 2024

Researcher: stealthcopter

JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-7136

Aug 15, 2024

Researcher: stealthcopter

ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-7064

Aug 14, 2024

Researcher: Webbernaut

Sheet to Table Live Sync for Google Sheet <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via STWT_Sheet_Table Shortcode

6.4

CVE-2024-6532

Aug 13, 2024

Researcher: Artem Polynko (Artem Polynko)

Gutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block

6.4

CVE-2024-7588

Aug 13, 2024

Researcher: lowol

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets

6.4

CVE-2024-7247

Aug 12, 2024

Researcher: Webbernaut

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter

6.4

CVE-2024-7092

Aug 12, 2024

Researcher: Webbernaut

Visual Composer Starter <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43263

Aug 12, 2024

Researcher: stealthcopter

Mega Addons For Elementor <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43267

Aug 12, 2024

Researcher: João Pedro Soares de Alcântara

Busiprof <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43262

Aug 12, 2024

Researcher: stealthcopter

WP Dashboard Notes <= 1.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVE-2024-43226

Aug 9, 2024

Researcher: akas wisnu aji

YaMaps for WordPress <= 0.6.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43224

Aug 9, 2024

Researcher: LVT-tholv2k

MDx <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item Shortcode

6.4

CVE-2024-6639

Aug 9, 2024

Researcher: Carson Chan

Enter Addons <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43225

Aug 9, 2024

Researcher: Michael

BetterDocs <= 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43227

Aug 9, 2024

Researcher: João Pedro Soares de Alcântara

Mediavine Control Panel <= 2.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43218

Aug 9, 2024

Researcher: LVT-tholv2k

LA-Studio Element Kit for Elementor <= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43210

Aug 9, 2024

Researcher: Khalid

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag

6.4

CVE-2024-4360

Aug 8, 2024

Researcher: Ngô Thiên An (ancorn_)

Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

6.4

CVE-2024-5226

Aug 7, 2024

Researcher: wesley (wcraft)

Themify Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-43133

Aug 7, 2024

Researcher: LVT-tholv2k

Title	CVE ID	CVSS	Researchers	Date
JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-7144	6.4	stealthcopter	August 15, 2024
JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-7136	6.4	stealthcopter	August 15, 2024
ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-7064	6.4	Webbernaut	August 14, 2024
Sheet to Table Live Sync for Google Sheet <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via STWT_Sheet_Table Shortcode	CVE-2024-6532	6.4	Artem Polynko (Artem Polynko)	August 13, 2024
Gutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block	CVE-2024-7588	6.4	lowol	August 13, 2024
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets	CVE-2024-7247	6.4	Webbernaut	August 12, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter	CVE-2024-7092	6.4	Webbernaut	August 12, 2024
Visual Composer Starter <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43263	6.4	stealthcopter	August 12, 2024
Mega Addons For Elementor <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43267	6.4	João Pedro Soares de Alcântara	August 12, 2024
Busiprof <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43262	6.4	stealthcopter	August 12, 2024
WP Dashboard Notes <= 1.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting	CVE-2024-43226	6.4	akas wisnu aji	August 9, 2024
YaMaps for WordPress <= 0.6.27 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43224	6.4	LVT-tholv2k	August 9, 2024
MDx <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item Shortcode	CVE-2024-6639	6.4	Carson Chan	August 9, 2024
Enter Addons <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43225	6.4	Michael	August 9, 2024
BetterDocs <= 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43227	6.4	João Pedro Soares de Alcântara	August 9, 2024
Mediavine Control Panel <= 2.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43218	6.4	LVT-tholv2k	August 9, 2024
LA-Studio Element Kit for Elementor <= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43210	6.4	Khalid	August 9, 2024
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag	CVE-2024-4360	6.4	Ngô Thiên An (ancorn_)	August 8, 2024
Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload	CVE-2024-5226	6.4	wesley (wcraft)	August 7, 2024
Themify Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-43133	6.4	LVT-tholv2k	August 7, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 26, 2024 Vulns
1	Francesco Carlucci	31
2	stealthcopter	26
3	vgo0	24
4	wesley (wcraft)	23
5	Lucio Sá	19
6	Daniel Ruf	11
7	Krzysztof Zając	10
8	Peter Thaleikis	7
9	Marco Wotschka	7
10	Webbernaut	7
11	Le Ngoc Anh	5
12	rezaduty	5
13	Muhammad Daffa	5
14	Fariq Fadillah Gusti Insani (fariqfgi)	4
15	István Márton	4
16	LVT-tholv2k	3
17	Seb	3
18	Robert DeVore	3
19	João Pedro Soares de Alcântara	3
20	Arkadiusz Hydzik	3

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation