WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
微信群发助手-Wechat Broadcast <= 1.2.0 - Directory Traversal
9.8
CVE-2018-16283
Sep 19, 2018
Researcher: Manuel Garcia Cardenas
File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download
9.8
CVE ID Unknown
Sep 17, 2018
Researchers:
UserPro <= 4.9.27 - Privilege Escalation
9.8
CVE ID Unknown
Sep 10, 2018
Researcher: Noman Riffat
wpForo < = 1.5.1 - Privilege Escalation
9.8
CVE-2018-16613
Sep 6, 2018
Researcher: 9emin1
Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution
9.8
CVE-2018-17207
Aug 29, 2018
Researchers: Thomas Chauchefoin, Julien Legras
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) < 4.1.8 - SQL Injection
9.8
CVE-2018-16159
Aug 26, 2018
Researcher: Renos Nikolaou
Chained Quiz <= 1.0.8.2 - Unauthenticated SQL Injection
9.8
CVE-2018-14502
Aug 16, 2018
Researcher: Qlirim Emini
Pie Register <= 3.0.9 - SQL Injection
9.8
CVE-2018-10969
Jun 12, 2018
Researcher: Manuel Garcia Cardenas
wpForo Forum <= 1.4.12 - SQL Injection
9.8
CVE-2018-11515
May 27, 2018
Researchers:
Membermouse <= 2.2.8 - Blind SQL Injection
9.8
CVE-2018-11309
May 27, 2018
Researcher: Riccardo Ancarani
Media File Manager <= 1.4.2 - Directory Traversal to Arbitrary File Relocation
9.8
CVE-2018-19042
May 11, 2018
Researcher: Pasquale Turi
Site Editor <= 1.1.1 - Local File Inclusion
9.8
CVE-2018-7422
Mar 16, 2018
Researcher: Nicolas Buzy-Debat
Newsletters <= 4.6.8.5 - Object Injection
9.8
CVE-2018-20987
Mar 12, 2018
Researchers:
WOOF - Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution
9.8
CVE-2018-8710
Mar 6, 2018
Researchers:
WOOF - Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion
9.8
CVE-2018-8711
Mar 6, 2018
Researchers:
Social Share, Social Login and Social Comments <= 7.10.6 - Authentication Bypass
9.8
CVE ID Unknown
Mar 3, 2018
Researchers:
WP Job Manager <= 1.29.2 - PHP Object Injection
9.8
CVE ID Unknown
Mar 2, 2018
Researchers:
WP Support Plus Responsive Ticket System <= 9.0.2 - SQL Injection
9.8
CVE-2018-1000131
Feb 25, 2018
Researcher: 00theway
Deep Blue <= 1.9.2 - Arbitrary File Upload
9.8
CVE ID Unknown
Feb 19, 2018
Researcher: Sammy Forgit
Swape - App Showcase & App Store WordPress Theme < 1.2.1 - Missing Authorization to Arbitrary Options Update
9.8
CVE-2018-21013
Feb 8, 2018
Researcher: Aaron Bernstein
Title CVE ID CVSS Researchers Date
微信群发助手-Wechat Broadcast <= 1.2.0 - Directory Traversal CVE-2018-16283 9.8 Manuel Garcia Cardenas September 19, 2018
File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download 9.8 September 17, 2018
UserPro <= 4.9.27 - Privilege Escalation 9.8 Noman Riffat September 10, 2018
wpForo < = 1.5.1 - Privilege Escalation CVE-2018-16613 9.8 9emin1 September 6, 2018
Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution CVE-2018-17207 9.8 Thomas Chauchefoin, Julien Legras August 29, 2018
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) < 4.1.8 - SQL Injection CVE-2018-16159 9.8 Renos Nikolaou August 26, 2018
Chained Quiz <= 1.0.8.2 - Unauthenticated SQL Injection CVE-2018-14502 9.8 Qlirim Emini August 16, 2018
Pie Register <= 3.0.9 - SQL Injection CVE-2018-10969 9.8 Manuel Garcia Cardenas June 12, 2018
wpForo Forum <= 1.4.12 - SQL Injection CVE-2018-11515 9.8 May 27, 2018
Membermouse <= 2.2.8 - Blind SQL Injection CVE-2018-11309 9.8 Riccardo Ancarani May 27, 2018
Media File Manager <= 1.4.2 - Directory Traversal to Arbitrary File Relocation CVE-2018-19042 9.8 Pasquale Turi May 11, 2018
Site Editor <= 1.1.1 - Local File Inclusion CVE-2018-7422 9.8 Nicolas Buzy-Debat March 16, 2018
Newsletters <= 4.6.8.5 - Object Injection CVE-2018-20987 9.8 March 12, 2018
WOOF - Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution CVE-2018-8710 9.8 March 6, 2018
WOOF - Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion CVE-2018-8711 9.8 March 6, 2018
Social Share, Social Login and Social Comments <= 7.10.6 - Authentication Bypass 9.8 March 3, 2018
WP Job Manager <= 1.29.2 - PHP Object Injection 9.8 March 2, 2018
WP Support Plus Responsive Ticket System <= 9.0.2 - SQL Injection CVE-2018-1000131 9.8 00theway February 25, 2018
Deep Blue <= 1.9.2 - Arbitrary File Upload 9.8 Sammy Forgit February 19, 2018
Swape - App Showcase & App Store WordPress Theme < 1.2.1 - Missing Authorization to Arbitrary Options Update CVE-2018-21013 9.8 Aaron Bernstein February 8, 2018
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 23, 2024
Vulns
1 stealthcopter 23
2 wesley (wcraft) 19
3 Francesco Carlucci 18
4 vgo0 15
5 Lucio Sá 14
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Marco Wotschka 7
10 Daniel Ruf 6
11 Krzysztof Zając 6
12 Muhammad Daffa 6
13 João Pedro Soares de Alcântara 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Le Ngoc Anh 5
16 István Márton 4
17 Peter Thaleikis 4
18 LVT-tholv2k 4
19 Webbernaut 4
20 rezaduty 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation