WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard < 2.0.9.2 - Authentication Bypass
9.8
CVE ID Unknown
Mar 9, 2015
Researcher: MICKAEL NADEAU (Sucuri)
Daily Edition <= 1.6.2 - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 7, 2015
Researcher: Jing Wang
Daily Edition <= 1.6.2 - SQL Injection
9.8
CVE ID Unknown
Mar 7, 2015
Researcher: Wang Jing
Ya'aburnee <= 1.0.7 and Dignitas <= 1.1.9 - Privilege Escalation
9.8
CVE ID Unknown
Mar 4, 2015
Researcher: Evex
DesignFolio Plus Theme (Unkown Versions) - Arbitrary File Upload
9.8
CVE-2015-10087
Mar 4, 2015
Researcher: CrashBandicot
Calculated Fields Form <= 1.0.11 - Cross-Site Request Forgery to SQL Injection
9.8
CVE ID Unknown
Mar 2, 2015
Researcher: Ibrahim Raafat
Gravityforms <= 1.8.19 - Arbitrary File Upload
9.8
CVE ID Unknown
Feb 26, 2015
Researchers:
IP Blacklist Cloud < 3.41 - SQL Injections
9.8
CVE ID Unknown
Feb 26, 2015
Researcher: Mika Epstein
SpiderCalendar <= 1.4.9 - Unauthenticated SQL Injection
9.8
CVE-2015-2196
Feb 13, 2015
Researcher: Mateusz Lach
CP Appointment Calendar <= 1.1.5 - Unauthenticated SQL Injection
9.8
CVE-2015-10099
Feb 12, 2015
Researchers:
Wordpress Video Gallery <= 2.7 - SQL Injection
9.8
CVE-2015-2065
Feb 12, 2015
Researcher: Claudio Viviani
Cherry Plugin < 1.2.7 - Arbitrary File Upload
9.8
CVE ID Unknown
Feb 10, 2015
Researchers:
Store Locator < 3.34 - SQL Injection
9.8
CVE ID Unknown
Feb 9, 2015
Researcher: James Hooker
Feed Them Social <= 1.6.9 - Arbitrary Shortcode Execution
9.8
CVE-2015-9351
Feb 2, 2015
Researcher: James Hooker
WordPress File Upload <= 2.4.6 - Arbitrary File Upload
9.8
CVE-2015-9338
Jan 23, 2015
Researchers:
Platform < 1.4.4 - Missing Authorization
9.8
CVE ID Unknown
Jan 21, 2015
Researcher: Marc-Alexandre Montpas
Pagelines Theme < 1.4.6 - Missing Authorization
9.8
CVE ID Unknown
Jan 20, 2015
Researcher: Sucuri Research Team
Pixabay Images <= 2.0 - Authentication Bypass to Arbitrary File Upload
9.8
CVE-2015-1375
Jan 19, 2015
Researcher: Mogwai, IT-Sicherheitsberatung Munich
Holding Pattern <= 0.6 - Arbitrary File Upload
9.8
CVE-2015-1172
Jan 18, 2015
Researcher: Alexander Borg
CIP4 Folder Download Widget < 1.11 - Local File Inclusion
9.8
CVE ID Unknown
Jan 13, 2015
Researcher: Ben khlifa Fahmi (XTnR3v0lt)
Title CVE ID CVSS Researchers Date
MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard < 2.0.9.2 - Authentication Bypass 9.8 MICKAEL NADEAU (Sucuri) March 9, 2015
Daily Edition <= 1.6.2 - Arbitrary File Upload 9.8 Jing Wang March 7, 2015
Daily Edition <= 1.6.2 - SQL Injection 9.8 Wang Jing March 7, 2015
Ya'aburnee <= 1.0.7 and Dignitas <= 1.1.9 - Privilege Escalation 9.8 Evex March 4, 2015
DesignFolio Plus Theme (Unkown Versions) - Arbitrary File Upload CVE-2015-10087 9.8 CrashBandicot March 4, 2015
Calculated Fields Form <= 1.0.11 - Cross-Site Request Forgery to SQL Injection 9.8 Ibrahim Raafat March 2, 2015
Gravityforms <= 1.8.19 - Arbitrary File Upload 9.8 February 26, 2015
IP Blacklist Cloud < 3.41 - SQL Injections 9.8 Mika Epstein February 26, 2015
SpiderCalendar <= 1.4.9 - Unauthenticated SQL Injection CVE-2015-2196 9.8 Mateusz Lach February 13, 2015
CP Appointment Calendar <= 1.1.5 - Unauthenticated SQL Injection CVE-2015-10099 9.8 February 12, 2015
Wordpress Video Gallery <= 2.7 - SQL Injection CVE-2015-2065 9.8 Claudio Viviani February 12, 2015
Cherry Plugin < 1.2.7 - Arbitrary File Upload 9.8 February 10, 2015
Store Locator < 3.34 - SQL Injection 9.8 James Hooker February 9, 2015
Feed Them Social <= 1.6.9 - Arbitrary Shortcode Execution CVE-2015-9351 9.8 James Hooker February 2, 2015
WordPress File Upload <= 2.4.6 - Arbitrary File Upload CVE-2015-9338 9.8 January 23, 2015
Platform < 1.4.4 - Missing Authorization 9.8 Marc-Alexandre Montpas January 21, 2015
Pagelines Theme < 1.4.6 - Missing Authorization 9.8 Sucuri Research Team January 20, 2015
Pixabay Images <= 2.0 - Authentication Bypass to Arbitrary File Upload CVE-2015-1375 9.8 Mogwai, IT-Sicherheitsberatung Munich January 19, 2015
Holding Pattern <= 0.6 - Arbitrary File Upload CVE-2015-1172 9.8 Alexander Borg January 18, 2015
CIP4 Folder Download Widget < 1.11 - Local File Inclusion 9.8 Ben khlifa Fahmi (XTnR3v0lt) January 13, 2015
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 24, 2024
Vulns
1 Francesco Carlucci 23
2 stealthcopter 23
3 wesley (wcraft) 22
4 vgo0 19
5 Lucio Sá 17
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Krzysztof Zając 8
10 Marco Wotschka 7
11 Muhammad Daffa 6
12 Daniel Ruf 6
13 João Pedro Soares de Alcântara 5
14 Peter Thaleikis 5
15 Le Ngoc Anh 5
16 Fariq Fadillah Gusti Insani (fariqfgi) 5
17 Webbernaut 4
18 rezaduty 4
19 István Márton 4
20 LVT-tholv2k 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation