WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Post Duplicator <= 2.23 - Cross-Site Scripting
6.4
CVE-2021-33852
Dec 2, 2021
Researchers:
Variation Swatches for WooCommerce <= 2.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2021-42367
Dec 1, 2021
Researcher: Chloe Chamberland
WordPress Download Manager <= 3.2.21 - Cross-Site Scripting
6.4
CVE-2021-24969
Nov 29, 2021
Researcher: Krzysztof Zając
Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting
6.4
CVE-2021-24982
Nov 18, 2021
Researcher: ZhongFu Su
Mortgage Calculator / Loan Calculator < 1.5.17 - Cross-Site Scripting
6.4
CVE-2021-24828
Nov 16, 2021
Researcher: apple502j
Get Custom Field Values <= 4.0.0 - Contributor+ Stored Cross-Site Scripting
6.4
CVE-2021-24871
Nov 9, 2021
Researcher: Francesco Carlucci
Testimonial Builder <= 1.6.1 - Authenticated Stored Cross-Site Scripting
6.4
CVE-2021-36857
Nov 7, 2021
Researcher: Ngo Van Thien
Ivory Search <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE ID Unknown
Nov 2, 2021
Researchers:
GenerateBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2021-24751
Nov 1, 2021
Researcher: apple502j
Hotel Listings < 1.3.3 - Authenticated Stored Cross-Site Scripting
6.4
CVE ID Unknown
Oct 28, 2021
Researcher: Vulnerability Lab
About Author Box < 1.0.2 - Cross-Site Scripting
6.4
CVE-2021-24745
Oct 26, 2021
Researcher: Francesco Carlucci
Insert Pages <= 3.6.1 - Contributor+ Stored Cross-Site Scripting
6.4
CVE-2021-24850
Oct 18, 2021
Researcher: Francesco Carlucci
Brizy - Page Builder <= 2.3.11 - Stored Cross-Site Scripting
6.4
CVE-2021-38344
Oct 13, 2021
Researcher: Ram
Support Board <= 3.3.4 - Agent+ Stored Cross-Site Scripting
6.4
CVE-2021-24807
Oct 7, 2021
Researcher: John Jefferson Li
Age Gate <= 2.16.3 - Stored Cross-Site Scripting
6.4
CVE ID Unknown
Oct 6, 2021
Researcher: Martin Vierula
Cool Tag Cloud <= 2.25 - Contributor+ Stored Cross-Site Scripting
6.4
CVE-2021-24682
Sep 28, 2021
Researcher: apple502j
Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection
6.4
CVE-2021-34648
Sep 22, 2021
Researcher: Chloe Chamberland
Responsive WordPress Slider <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2021-24544
Sep 21, 2021
Researchers: Veshraj Ghimire, Abhiyan Chhetri
Html5 Audio Player <= 2.1.2 - Contributor+ Stored Cross-Site Scripting
6.4
CVE-2021-24412
Sep 20, 2021
Researcher: Michal Lipinski
Easy Twitter Feed < 1.2 - Cross-Site Scripting
6.4
CVE-2021-24413
Sep 20, 2021
Researcher: Michal Lipinski
Title CVE ID CVSS Researchers Date
Post Duplicator <= 2.23 - Cross-Site Scripting CVE-2021-33852 6.4 December 2, 2021
Variation Swatches for WooCommerce <= 2.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2021-42367 6.4 Chloe Chamberland December 1, 2021
WordPress Download Manager <= 3.2.21 - Cross-Site Scripting CVE-2021-24969 6.4 Krzysztof Zając November 29, 2021
Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting CVE-2021-24982 6.4 ZhongFu Su November 18, 2021
Mortgage Calculator / Loan Calculator < 1.5.17 - Cross-Site Scripting CVE-2021-24828 6.4 apple502j November 16, 2021
Get Custom Field Values <= 4.0.0 - Contributor+ Stored Cross-Site Scripting CVE-2021-24871 6.4 Francesco Carlucci November 9, 2021
Testimonial Builder <= 1.6.1 - Authenticated Stored Cross-Site Scripting CVE-2021-36857 6.4 Ngo Van Thien November 7, 2021
Ivory Search <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 November 2, 2021
GenerateBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2021-24751 6.4 apple502j November 1, 2021
Hotel Listings < 1.3.3 - Authenticated Stored Cross-Site Scripting 6.4 Vulnerability Lab October 28, 2021
About Author Box < 1.0.2 - Cross-Site Scripting CVE-2021-24745 6.4 Francesco Carlucci October 26, 2021
Insert Pages <= 3.6.1 - Contributor+ Stored Cross-Site Scripting CVE-2021-24850 6.4 Francesco Carlucci October 18, 2021
Brizy - Page Builder <= 2.3.11 - Stored Cross-Site Scripting CVE-2021-38344 6.4 Ram October 13, 2021
Support Board <= 3.3.4 - Agent+ Stored Cross-Site Scripting CVE-2021-24807 6.4 John Jefferson Li October 7, 2021
Age Gate <= 2.16.3 - Stored Cross-Site Scripting 6.4 Martin Vierula October 6, 2021
Cool Tag Cloud <= 2.25 - Contributor+ Stored Cross-Site Scripting CVE-2021-24682 6.4 apple502j September 28, 2021
Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection CVE-2021-34648 6.4 Chloe Chamberland September 22, 2021
Responsive WordPress Slider <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2021-24544 6.4 Veshraj Ghimire, Abhiyan Chhetri September 21, 2021
Html5 Audio Player <= 2.1.2 - Contributor+ Stored Cross-Site Scripting CVE-2021-24412 6.4 Michal Lipinski September 20, 2021
Easy Twitter Feed < 1.2 - Cross-Site Scripting CVE-2021-24413 6.4 Michal Lipinski September 20, 2021
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 23, 2024
Vulns
1 stealthcopter 23
2 wesley (wcraft) 19
3 Francesco Carlucci 18
4 vgo0 15
5 Lucio Sá 14
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Marco Wotschka 7
10 Daniel Ruf 6
11 Krzysztof Zając 6
12 Muhammad Daffa 6
13 João Pedro Soares de Alcântara 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Le Ngoc Anh 5
16 István Márton 4
17 Peter Thaleikis 4
18 LVT-tholv2k 4
19 Webbernaut 4
20 rezaduty 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation