WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-4485
May 23, 2024
Researcher: Ngô Thiên An (ancorn_)
The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box
6.4
CVE-2024-3718
May 23, 2024
Researcher: stealthcopter
Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-4366
May 23, 2024
Researcher: Ngô Thiên An (ancorn_)
The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card
6.4
CVE-2024-2784
May 23, 2024
Researcher: Colin Xu
WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode
6.4
CVE-2024-4043
May 22, 2024
Researcher: Krzysztof Zając
Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets
6.4
CVE-2024-5177
May 22, 2024
Researcher: stealthcopter
LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
CVE-2024-4431
May 22, 2024
Researcher: stealthcopter
WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-3201
May 22, 2024
Researcher: Krzysztof Zając
jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode
6.4
CVE-2024-4783
May 22, 2024
Researcher: Krzysztof Zając
Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget
6.4
CVE-2024-4486
May 22, 2024
Researcher: stealthcopter
ShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons Shortcode
6.4
CVE-2024-3648
May 22, 2024
Researcher: Krzysztof Zając
ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget
6.4
CVE-2024-2861
May 22, 2024
Researcher: wesley (wcraft)
LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode
6.4
CVE-2024-4575
May 22, 2024
Researcher: haidv35
WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode
6.4
CVE-2024-4706
May 22, 2024
Researcher: stealthcopter
Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider
6.4
CVE-2024-4378
May 22, 2024
Researcher: stealthcopter
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget
6.4
CVE-2024-3997
May 22, 2024
Researcher: Ngô Thiên An (ancorn_)
Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block
6.4
CVE-2024-1814
May 22, 2024
Researcher: wesley (wcraft)
Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block
6.4
CVE-2024-1815
May 22, 2024
Researcher: wesley (wcraft)
Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-4365
May 22, 2024
Researcher: wesley (wcraft)
WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
6.4
CVE-2024-4896
May 21, 2024
Researcher: stealthcopter
Title CVE ID CVSS Researchers Date
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4485 6.4 Ngô Thiên An (ancorn_) May 23, 2024
The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box CVE-2024-3718 6.4 stealthcopter May 23, 2024
Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-4366 6.4 Ngô Thiên An (ancorn_) May 23, 2024
The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card CVE-2024-2784 6.4 Colin Xu May 23, 2024
WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode CVE-2024-4043 6.4 Krzysztof Zając May 22, 2024
Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets CVE-2024-5177 6.4 stealthcopter May 22, 2024
LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CVE-2024-4431 6.4 stealthcopter May 22, 2024
WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-3201 6.4 Krzysztof Zając May 22, 2024
jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode CVE-2024-4783 6.4 Krzysztof Zając May 22, 2024
Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget CVE-2024-4486 6.4 stealthcopter May 22, 2024
ShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons Shortcode CVE-2024-3648 6.4 Krzysztof Zając May 22, 2024
ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget CVE-2024-2861 6.4 wesley (wcraft) May 22, 2024
LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode CVE-2024-4575 6.4 haidv35 May 22, 2024
WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode CVE-2024-4706 6.4 stealthcopter May 22, 2024
Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider CVE-2024-4378 6.4 stealthcopter May 22, 2024
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget CVE-2024-3997 6.4 Ngô Thiên An (ancorn_) May 22, 2024
Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block CVE-2024-1814 6.4 wesley (wcraft) May 22, 2024
Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block CVE-2024-1815 6.4 wesley (wcraft) May 22, 2024
Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4365 6.4 wesley (wcraft) May 22, 2024
WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter CVE-2024-4896 6.4 stealthcopter May 21, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 25, 2024
Vulns
1 Francesco Carlucci 23
2 stealthcopter 23
3 wesley (wcraft) 22
4 vgo0 19
5 Lucio Sá 17
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Krzysztof Zając 8
10 Marco Wotschka 7
11 Muhammad Daffa 6
12 Daniel Ruf 6
13 João Pedro Soares de Alcântara 5
14 Peter Thaleikis 5
15 Le Ngoc Anh 5
16 Fariq Fadillah Gusti Insani (fariqfgi) 5
17 Webbernaut 4
18 rezaduty 4
19 István Márton 4
20 LVT-tholv2k 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation