WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WP Markdown Editor (Formerly Dark Mode) < 1.7 - Stored Cross-Site Scripting
6.4
CVE-2018-5652
Jan 12, 2018
Researcher: d4wner
Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting
6.4
CVE-2018-5212
Jan 2, 2018
Researcher: d4wner
Woocommerce CSV importer <= 3.3.6 - Arbitrary File Deletion
6.4
CVE ID Unknown
Dec 27, 2017
Researcher: Lenon Leite
WordPress Core < 4.9.1 - Authenticated Stored Cross-Site Scripting
6.4
CVE-2017-17092
Nov 29, 2017
Researchers:
WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language
6.4
CVE-2017-17093
Nov 29, 2017
Researchers:
Affiliate Ads for Clickbank Products < 1.7 - Stored Cross-Site Scripting
6.4
CVE-2017-18011
Nov 14, 2017
Researcher: Ricardo Sanchez
WP Mail Logging <= 1.8.2 - Cross-Site Scripting
6.4
CVE ID Unknown
Nov 11, 2017
Researcher: Saad Iqbal
Email Log <= 2.2.2 - Stored Cross-Site Scripting
6.4
CVE ID Unknown
Nov 11, 2017
Researcher: Saad Iqbal
WordPress Core < 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs
6.4
CVE-2017-14718
Sep 19, 2017
Researcher: Anas Roubi (qasuar)
WordPress Core < 4.8.2 - Cross-Site Scripting in oEmbed
6.4
CVE-2017-14724
Sep 19, 2017
Researcher: xknown
WordPress Core < 4.8.2 - Cross-Site Scripting via Shortcodes
6.4
CVE-2017-14726
Sep 19, 2017
Researcher: Rodolfo Assis (@brutelogic)
WordPress Core < 4.8.2 - Cross-Site Scripting via Template Name
6.4
CVE-2017-14720
Sep 19, 2017
Researcher: Luka Sikic
Salutation < 3.0.16 - Authenticated Stored Cross-Site Scripting
6.4
CVE-2017-1000227
Jul 31, 2017
Researcher: Mallory Adams
Salutation Responsive WordPress Theme < 3.0.16 - Authenticated Stored Cross-Site Scripting
6.4
CVE-2017-1000227
Jul 31, 2017
Researcher: Mallory Adams
Task Manager Pro <= 1.3.1 - Stored Cross-Site Scripting
6.4
CVE ID Unknown
Jul 11, 2017
Researcher: 8bitsec
EventCalendar < 1.0.94 - Authenticated Cross-Site Scripting
6.4
CVE-2017-2224
Jun 20, 2017
Researcher: Chris Liu
WordPress Core < 4.7.5 - Stored Cross-Site Scripting via filenames
6.4
CVE-2017-9061
May 16, 2017
Researcher: Ronnie Skansing
WordPress Core < 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds
6.4
CVE-2017-6817
Mar 6, 2017
Researcher: Marc-Alexandre Montpas
WordPress Core < 4.7.3 - Cross-Site Scripting via Taxonomy names
6.4
CVE-2017-6818
Mar 6, 2017
Researcher: Delta
WordPress Core < 4.7.3 - Cross-Site Scripting via Media Metadata
6.4
CVE-2017-6814
Mar 6, 2017
Researchers: Chris Andrè Dale, Simon P. Briggs, Yorick Koster,
Title CVE ID CVSS Researchers Date
WP Markdown Editor (Formerly Dark Mode) < 1.7 - Stored Cross-Site Scripting CVE-2018-5652 6.4 d4wner January 12, 2018
Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting CVE-2018-5212 6.4 d4wner January 2, 2018
Woocommerce CSV importer <= 3.3.6 - Arbitrary File Deletion 6.4 Lenon Leite December 27, 2017
WordPress Core < 4.9.1 - Authenticated Stored Cross-Site Scripting CVE-2017-17092 6.4 November 29, 2017
WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language CVE-2017-17093 6.4 November 29, 2017
Affiliate Ads for Clickbank Products < 1.7 - Stored Cross-Site Scripting CVE-2017-18011 6.4 Ricardo Sanchez November 14, 2017
WP Mail Logging <= 1.8.2 - Cross-Site Scripting 6.4 Saad Iqbal November 11, 2017
Email Log <= 2.2.2 - Stored Cross-Site Scripting 6.4 Saad Iqbal November 11, 2017
WordPress Core < 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs CVE-2017-14718 6.4 Anas Roubi (qasuar) September 19, 2017
WordPress Core < 4.8.2 - Cross-Site Scripting in oEmbed CVE-2017-14724 6.4 xknown September 19, 2017
WordPress Core < 4.8.2 - Cross-Site Scripting via Shortcodes CVE-2017-14726 6.4 Rodolfo Assis (@brutelogic) September 19, 2017
WordPress Core < 4.8.2 - Cross-Site Scripting via Template Name CVE-2017-14720 6.4 Luka Sikic September 19, 2017
Salutation < 3.0.16 - Authenticated Stored Cross-Site Scripting CVE-2017-1000227 6.4 Mallory Adams July 31, 2017
Salutation Responsive WordPress Theme < 3.0.16 - Authenticated Stored Cross-Site Scripting CVE-2017-1000227 6.4 Mallory Adams July 31, 2017
Task Manager Pro <= 1.3.1 - Stored Cross-Site Scripting 6.4 8bitsec July 11, 2017
EventCalendar < 1.0.94 - Authenticated Cross-Site Scripting CVE-2017-2224 6.4 Chris Liu June 20, 2017
WordPress Core < 4.7.5 - Stored Cross-Site Scripting via filenames CVE-2017-9061 6.4 Ronnie Skansing May 16, 2017
WordPress Core < 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds CVE-2017-6817 6.4 Marc-Alexandre Montpas March 6, 2017
WordPress Core < 4.7.3 - Cross-Site Scripting via Taxonomy names CVE-2017-6818 6.4 Delta March 6, 2017
WordPress Core < 4.7.3 - Cross-Site Scripting via Media Metadata CVE-2017-6814 6.4 Chris Andrè Dale, Simon P. Briggs, Yorick Koster, March 6, 2017
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 24, 2024
Vulns
1 stealthcopter 23
2 wesley (wcraft) 22
3 Francesco Carlucci 19
4 vgo0 19
5 Lucio Sá 15
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Krzysztof Zając 8
10 Marco Wotschka 7
11 Muhammad Daffa 6
12 Daniel Ruf 6
13 João Pedro Soares de Alcântara 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Le Ngoc Anh 5
16 Peter Thaleikis 4
17 LVT-tholv2k 4
18 Webbernaut 4
19 István Márton 4
20 rezaduty 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation