WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WP To Do <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-22292
Jan 17, 2024
Researcher: Kang SeoHee
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag
6.4
CVE-2024-0382
Jan 17, 2024
Researcher: wesley (wcraft)
CBX Map for Google Map & OpenStreetMap <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-22297
Jan 17, 2024
Researcher: Ngô Thiên An (ancorn_)
WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-6958
Jan 17, 2024
Researcher: wesley (wcraft)
Albo Pretorio Online <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-22302
Jan 17, 2024
Researcher: Ngô Thiên An (ancorn_)
Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
6.4
CVE-2024-22150
Jan 16, 2024
Researcher: Ngô Thiên An (ancorn_)
PeepSo Core: Photos < 6.3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-22158
Jan 16, 2024
Researcher: Bikram Kharal
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data
6.4
CVE-2023-6982
Jan 16, 2024
Researcher: Francesco Carlucci
Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget
6.4
CVE-2024-0508
Jan 15, 2024
Researcher: Webbernaut
WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE ID Unknown
Jan 12, 2024
Researchers:
Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
6.4
CVE-2023-6884
Jan 12, 2024
Researcher: Akbar Kustirama
Constant Contact Forms by MailMunch <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-22137
Jan 10, 2024
Researcher: Abu Hurayra
Voting Record <= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2023-7084
Jan 10, 2024
Researcher: Daniel Ruf
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-7071
Jan 9, 2024
Researcher: Webbernaut
Email Encoder – Protect Email Addresses and Phone Numbers <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-7070
Jan 9, 2024
Researcher: Webbernaut
Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE ID Unknown
Jan 9, 2024
Researchers:
Football pool <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-29802
Jan 8, 2024
Researcher: Ngô Thiên An (ancorn_)
OneClick Chat to Order <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE ID Unknown
Jan 8, 2024
Researchers:
Beds24 Online Booking <= 2.0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-52228
Jan 8, 2024
Researcher: Ngô Thiên An (ancorn_)
Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
6.4
CVE-2023-6938
Jan 5, 2024
Researcher: Francesco Carlucci
Title CVE ID CVSS Researchers Date
WP To Do <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-22292 6.4 Kang SeoHee January 17, 2024
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag CVE-2024-0382 6.4 wesley (wcraft) January 17, 2024
CBX Map for Google Map & OpenStreetMap <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-22297 6.4 Ngô Thiên An (ancorn_) January 17, 2024
WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-6958 6.4 wesley (wcraft) January 17, 2024
Albo Pretorio Online <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-22302 6.4 Ngô Thiên An (ancorn_) January 17, 2024
Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode CVE-2024-22150 6.4 Ngô Thiên An (ancorn_) January 16, 2024
PeepSo Core: Photos < 6.3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-22158 6.4 Bikram Kharal January 16, 2024
Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data CVE-2023-6982 6.4 Francesco Carlucci January 16, 2024
Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget CVE-2024-0508 6.4 Webbernaut January 15, 2024
WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 January 12, 2024
Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode CVE-2023-6884 6.4 Akbar Kustirama January 12, 2024
Constant Contact Forms by MailMunch <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-22137 6.4 Abu Hurayra January 10, 2024
Voting Record <= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2023-7084 6.4 Daniel Ruf January 10, 2024
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-7071 6.4 Webbernaut January 9, 2024
Email Encoder – Protect Email Addresses and Phone Numbers <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-7070 6.4 Webbernaut January 9, 2024
Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 January 9, 2024
Football pool <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-29802 6.4 Ngô Thiên An (ancorn_) January 8, 2024
OneClick Chat to Order <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 6.4 January 8, 2024
Beds24 Online Booking <= 2.0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-52228 6.4 Ngô Thiên An (ancorn_) January 8, 2024
Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2023-6938 6.4 Francesco Carlucci January 5, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 21, 2024
Vulns
1 stealthcopter 24
2 Francesco Carlucci 20
3 wesley (wcraft) 19
4 Lucio Sá 19
5 Daniel Ruf 16
6 vgo0 15
7 Rafie Muhammad 12
8 Dave Jong 11
9 Ananda Dhakal 9
10 Marco Wotschka 8
11 Muhammad Daffa 6
12 Krzysztof Zając 6
13 João Pedro Soares de Alcântara 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Webbernaut 5
16 Le Ngoc Anh 5
17 Bob Matyas 5
18 Peter Thaleikis 4
19 LVT-tholv2k 4
20 rezaduty 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation