WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting
6.4
CVE-2023-27926
May 9, 2023
Researcher: apple502j
TheGem < 5.8.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2023-32237
May 5, 2023
Researcher: Dave Jong
Manager for Icomoon <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-29387
May 4, 2023
Researcher: deokhunKim
Library Viewer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-32102
May 3, 2023
Researcher: Mika
OSM - OpenStreetMap <= 6.0.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via 'osm_map' Shortcode
6.4
CVE-2022-4676
May 3, 2023
Researcher: István Márton
WOLF <= 1.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpbe_update_page_field
6.4
CVE-2023-31218
May 3, 2023
Researcher: Junsu Yeo
TP Education <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes
6.4
CVE-2023-32103
May 3, 2023
Researcher: deokhunKim
User IP and Location <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-30780
Apr 28, 2023
Researcher: deokhunKim
Plugins List <= 2.5 - Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags
6.4
CVE-2023-31232
Apr 28, 2023
Researcher: Yuki Haruma
ClickFunnels <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2022-4782
Apr 26, 2023
Researcher: István Márton
REST API TO MiniProgram <= 4.7.1 - Authenticated (Subscriber+) Media Attachment Deletion
6.4
CVE-2023-0551
Apr 25, 2023
Researcher: István Márton
URL Params <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-0274
Apr 25, 2023
Researcher: István Márton
Rating Widget <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes
6.4
CVE-2023-23831
Apr 24, 2023
Researcher: István Márton
Arconix Shortcodes <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
6.4
CVE-2023-23703
Apr 24, 2023
Researcher: István Márton
Progress Bar <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppb shortcode
6.4
CVE-2023-23699
Apr 24, 2023
Researcher: yuyudhn
Tippy <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode
6.4
CVE-2023-31079
Apr 24, 2023
Researcher: Mika
Easy Slider Revolution <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter
6.4
CVE-2023-28622
Apr 21, 2023
Researcher: Yuki Haruma
ActiveCampaign – Forms, Site Tracking, Live Chat <= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-0233
Apr 20, 2023
Researcher: István Márton
Mail Subscribe List <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via smlsubform shortcode
6.4
CVE-2023-23657
Apr 20, 2023
Researcher: István Márton
WPJAM Basic <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-23709
Apr 20, 2023
Researcher: István Márton
Title CVE ID CVSS Researchers Date
VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting CVE-2023-27926 6.4 apple502j May 9, 2023
TheGem < 5.8.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2023-32237 6.4 Dave Jong May 5, 2023
Manager for Icomoon <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-29387 6.4 deokhunKim May 4, 2023
Library Viewer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-32102 6.4 Mika May 3, 2023
OSM - OpenStreetMap <= 6.0.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via 'osm_map' Shortcode CVE-2022-4676 6.4 István Márton May 3, 2023
WOLF <= 1.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpbe_update_page_field CVE-2023-31218 6.4 Junsu Yeo May 3, 2023
TP Education <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes CVE-2023-32103 6.4 deokhunKim May 3, 2023
User IP and Location <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-30780 6.4 deokhunKim April 28, 2023
Plugins List <= 2.5 - Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags CVE-2023-31232 6.4 Yuki Haruma April 28, 2023
ClickFunnels <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2022-4782 6.4 István Márton April 26, 2023
REST API TO MiniProgram <= 4.7.1 - Authenticated (Subscriber+) Media Attachment Deletion CVE-2023-0551 6.4 István Márton April 25, 2023
URL Params <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-0274 6.4 István Márton April 25, 2023
Rating Widget <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes CVE-2023-23831 6.4 István Márton April 24, 2023
Arconix Shortcodes <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode CVE-2023-23703 6.4 István Márton April 24, 2023
Progress Bar <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppb shortcode CVE-2023-23699 6.4 yuyudhn April 24, 2023
Tippy <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode CVE-2023-31079 6.4 Mika April 24, 2023
Easy Slider Revolution <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter CVE-2023-28622 6.4 Yuki Haruma April 21, 2023
ActiveCampaign – Forms, Site Tracking, Live Chat <= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-0233 6.4 István Márton April 20, 2023
Mail Subscribe List <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via smlsubform shortcode CVE-2023-23657 6.4 István Márton April 20, 2023
WPJAM Basic <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-23709 6.4 István Márton April 20, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 21, 2024
Vulns
1 stealthcopter 24
2 Francesco Carlucci 20
3 wesley (wcraft) 19
4 Lucio Sá 19
5 Daniel Ruf 16
6 vgo0 15
7 Rafie Muhammad 12
8 Dave Jong 11
9 Ananda Dhakal 9
10 Marco Wotschka 8
11 Muhammad Daffa 6
12 Krzysztof Zając 6
13 João Pedro Soares de Alcântara 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Webbernaut 5
16 Le Ngoc Anh 5
17 Bob Matyas 5
18 Peter Thaleikis 4
19 LVT-tholv2k 4
20 rezaduty 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation