🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers, top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation

9.8

CVE ID Unknown

May 29, 2019

Researcher: Mikey Veenstra

WP Booking System Free version < 1.5.2 - Cross-Site Request Forgery

9.8

CVE-2019-12239

May 22, 2019

Researcher: Magnus K. Stubman

FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection

9.8

CVE-2019-14801

May 20, 2019

Researchers:

WPGraphQL <= 0.2.3 - Administrative User Creation

9.8

CVE-2019-9879

May 8, 2019

Researcher: Simone Quatrini

Carts Guru <= 1.4.5 - PHP Object Injection

9.8

CVE-2019-12241

May 7, 2019

Researcher: Magnus K. Stubman

WP Live Chat Support Pro <= 8.0.26 - Arbitrary File Upload

9.8

CVE-2019-11185

May 7, 2019

Researcher: Alert Logic

Virim <= 0.4 - PHP Object Injection

9.8

CVE-2019-12240

May 7, 2019

Researcher: Magnus K. Stubman

User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload

9.8

CVE-2019-25138

May 2, 2019

Researcher: Jerome Bruandet

RSVPMaker <= 6.1.9 - SQL Injection

9.8

CVE-2019-15646

Apr 28, 2019

Researchers:

Print My Blog <= 1.6.6 - Server-Side Request Forgery

9.8

CVE-2019-11565

Apr 27, 2019

Researcher: Magnus K. Stubman

SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload

9.8

CVE-2019-11223

Apr 17, 2019

Researcher: Christian Angel

Visual CSS Style Editor <= 7.2.0 - Unauthenticated Arbitrary Options Update

9.8

CVE-2019-11886

Apr 11, 2019

Researchers:

Pipdig Power Pack (P3) <= 4.7.3 - Backdoor

9.8

CVE ID Unknown

Mar 29, 2019

Researchers: Mikey Veenstra, Jemjabella

WP Database Backup <= 5.1.2 - Unauthenticated Settings Update to Remote Code Execution

9.8

CVE ID Unknown

Mar 24, 2019

Researchers:

Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update

9.8

CVE-2019-25141

Mar 17, 2019

Researcher: Jerome Bruandet

SiteGround Optimizer <= 5.0.12 - Missing Authorization

9.8

CVE-2019-25217

Mar 14, 2019

Researcher: Marc-Alexandre Montpas

GraceMedia Media Player <= 1.0 - Local File Inclusion

9.8

CVE-2019-9618

Mar 13, 2019

Researcher: Manuel Garcia Cardenas

Caldera Forms Pro < 1.8.2 - Missing Authorization

9.8

CVE ID Unknown

Mar 13, 2019

Researcher: Marc-Alexandre Montpas

WP Live Chat Support Pro <= 8.0.06 - Remote Code Execution via unrestricted file upload

9.8

CVE-2018-12426

Mar 11, 2019

Researcher: Riccardo ten Cate

Indeed Membership Pro <= 7.5 - Arbitrary File Upload

9.8

CVE ID Unknown

Feb 26, 2019

Researcher: James Fraser

Title	CVE ID	CVSS	Researchers	Date
ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation		9.8	Mikey Veenstra	May 29, 2019
WP Booking System Free version < 1.5.2 - Cross-Site Request Forgery	CVE-2019-12239	9.8	Magnus K. Stubman	May 22, 2019
FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection	CVE-2019-14801	9.8		May 20, 2019
WPGraphQL <= 0.2.3 - Administrative User Creation	CVE-2019-9879	9.8	Simone Quatrini	May 8, 2019
Carts Guru <= 1.4.5 - PHP Object Injection	CVE-2019-12241	9.8	Magnus K. Stubman	May 7, 2019
WP Live Chat Support Pro <= 8.0.26 - Arbitrary File Upload	CVE-2019-11185	9.8	Alert Logic	May 7, 2019
Virim <= 0.4 - PHP Object Injection	CVE-2019-12240	9.8	Magnus K. Stubman	May 7, 2019
User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload	CVE-2019-25138	9.8	Jerome Bruandet	May 2, 2019
RSVPMaker <= 6.1.9 - SQL Injection	CVE-2019-15646	9.8		April 28, 2019
Print My Blog <= 1.6.6 - Server-Side Request Forgery	CVE-2019-11565	9.8	Magnus K. Stubman	April 27, 2019
SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload	CVE-2019-11223	9.8	Christian Angel	April 17, 2019
Visual CSS Style Editor <= 7.2.0 - Unauthenticated Arbitrary Options Update	CVE-2019-11886	9.8		April 11, 2019
Pipdig Power Pack (P3) <= 4.7.3 - Backdoor		9.8	Mikey Veenstra, Jemjabella	March 29, 2019
WP Database Backup <= 5.1.2 - Unauthenticated Settings Update to Remote Code Execution		9.8		March 24, 2019
Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update	CVE-2019-25141	9.8	Jerome Bruandet	March 17, 2019
SiteGround Optimizer <= 5.0.12 - Missing Authorization	CVE-2019-25217	9.8	Marc-Alexandre Montpas	March 14, 2019
GraceMedia Media Player <= 1.0 - Local File Inclusion	CVE-2019-9618	9.8	Manuel Garcia Cardenas	March 13, 2019
Caldera Forms Pro < 1.8.2 - Missing Authorization		9.8	Marc-Alexandre Montpas	March 13, 2019
WP Live Chat Support Pro <= 8.0.06 - Remote Code Execution via unrestricted file upload	CVE-2018-12426	9.8	Riccardo ten Cate	March 11, 2019
Indeed Membership Pro <= 7.5 - Arbitrary File Upload		9.8	James Fraser	February 26, 2019

Submit Vulnerability

«
‹
1
2
...
46
47
48
...
999
1000
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Oct 12, 2024 Vulns
1	SOPROBRO	105
2	Francesco Carlucci	55
3	João Pedro Soares de Alcântara	53
4	stealthcopter	53
5	István Márton	42
6	vgo0	29
7	Mika	29
8	Peter Thaleikis	28
9	Gab	26
10	LVT-tholv2k	25
11	theviper17y	19
12	Trương Hữu Phúc (truonghuuphuc)	17
13	wesley (wcraft)	17
14	Rafie Muhammad	15
15	Khalid Yusuf	10
16	Le Ngoc Anh	10
17	zer0gh0st	9
18	Joshua Chan	9
19	Colin Xu	8
20	Tonn	8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation