WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Ajax Search Lite < 3.11 - Remote Code Execution
9.8
CVE ID Unknown
Jun 24, 2014
Researcher: @u0x (Pichaya Morimoto)
Disqus Comment System < 2.76 - Remote Code Execution
9.8
CVE ID Unknown
Jun 20, 2014
Researcher: Marc-Alexandre Montpas
Participants Database < 1.5.4.9 - SQL Injection
9.8
CVE-2014-3961
Jun 2, 2014
Researcher: Yarubo Research Team
WP Rss Poster <= 1.0.0 - SQL Injection
9.8
CVE-2014-4938
May 28, 2014
Researcher: Anant Shrivastava (anantshri)
WP-lightpop <= 0.8.5.6 - Remote Media File Inclusion
9.8
CVE ID Unknown
May 25, 2014
Researcher: Prajal Kulkarni
Youtube Freedown <= 1.0 - Remote Media File Inclusion
9.8
CVE ID Unknown
May 25, 2014
Researcher: Prajal Kulkarni
Podcasting Plugin by TSG < 3.0.5 - Remote File Inclusion
9.8
CVE ID Unknown
May 25, 2014
Researcher: Prajal Kulkarni
pb-embedFlash <= 1.5.1 - Remote File Inclusion
9.8
CVE ID Unknown
May 25, 2014
Researcher: Prajal Kulkarni
µAudio Player <= 0.6.2 - Remote File Inclusion
9.8
CVE ID Unknown
May 25, 2014
Researcher: Prajal Kulkarni
Profile Builder – User Profile & User Registration Forms Plugin < 1.1.60 - Authentication Bypass
9.8
CVE ID Unknown
May 6, 2014
Researchers:
Echelon (All Versions) - Arbitrary File Upload
9.8
CVE ID Unknown
Apr 25, 2014
Researcher: Th3 R0cksT3r
Nightlife Theme (All Known Versions) - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 31, 2014
Researcher: Jje Incovers
Ajax Pagination (twitter Style) <= 1.1 - Local File Inclusion
9.8
CVE-2014-2674
Mar 28, 2014
Researcher: Glyn Wintle
WP Business intelligence lite < 1.3 - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 28, 2014
Researcher: Manish Kishan Tanwar
Leaflet Maps Marker Pro < 1.5.8 - SQL Injection
9.8
CVE ID Unknown
Mar 27, 2014
Researchers:
Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 27, 2014
Researchers:
Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 26, 2014
Researchers:
Appius Theme <= 1.0 - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 23, 2014
Researcher: CaFc Versace
Custom Background <= 3.2.2.67929 - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 23, 2014
Researcher: CaFc Versace
Felici (All Versions) - Arbitrary File Upload
9.8
CVE ID Unknown
Mar 22, 2014
Researcher: CaFc Versace
Title CVE ID CVSS Researchers Date
Ajax Search Lite < 3.11 - Remote Code Execution 9.8 @u0x (Pichaya Morimoto) June 24, 2014
Disqus Comment System < 2.76 - Remote Code Execution 9.8 Marc-Alexandre Montpas June 20, 2014
Participants Database < 1.5.4.9 - SQL Injection CVE-2014-3961 9.8 Yarubo Research Team June 2, 2014
WP Rss Poster <= 1.0.0 - SQL Injection CVE-2014-4938 9.8 Anant Shrivastava (anantshri) May 28, 2014
WP-lightpop <= 0.8.5.6 - Remote Media File Inclusion 9.8 Prajal Kulkarni May 25, 2014
Youtube Freedown <= 1.0 - Remote Media File Inclusion 9.8 Prajal Kulkarni May 25, 2014
Podcasting Plugin by TSG < 3.0.5 - Remote File Inclusion 9.8 Prajal Kulkarni May 25, 2014
pb-embedFlash <= 1.5.1 - Remote File Inclusion 9.8 Prajal Kulkarni May 25, 2014
µAudio Player <= 0.6.2 - Remote File Inclusion 9.8 Prajal Kulkarni May 25, 2014
Profile Builder – User Profile & User Registration Forms Plugin < 1.1.60 - Authentication Bypass 9.8 May 6, 2014
Echelon (All Versions) - Arbitrary File Upload 9.8 Th3 R0cksT3r April 25, 2014
Nightlife Theme (All Known Versions) - Arbitrary File Upload 9.8 Jje Incovers March 31, 2014
Ajax Pagination (twitter Style) <= 1.1 - Local File Inclusion CVE-2014-2674 9.8 Glyn Wintle March 28, 2014
WP Business intelligence lite < 1.3 - Arbitrary File Upload 9.8 Manish Kishan Tanwar March 28, 2014
Leaflet Maps Marker Pro < 1.5.8 - SQL Injection 9.8 March 27, 2014
Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload 9.8 March 27, 2014
Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload 9.8 March 26, 2014
Appius Theme <= 1.0 - Arbitrary File Upload 9.8 CaFc Versace March 23, 2014
Custom Background <= 3.2.2.67929 - Arbitrary File Upload 9.8 CaFc Versace March 23, 2014
Felici (All Versions) - Arbitrary File Upload 9.8 CaFc Versace March 22, 2014
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 25, 2024
Vulns
1 Francesco Carlucci 23
2 stealthcopter 23
3 wesley (wcraft) 22
4 vgo0 19
5 Lucio Sá 17
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Krzysztof Zając 8
10 Marco Wotschka 7
11 Muhammad Daffa 6
12 Daniel Ruf 6
13 João Pedro Soares de Alcântara 5
14 Peter Thaleikis 5
15 Le Ngoc Anh 5
16 Fariq Fadillah Gusti Insani (fariqfgi) 5
17 Webbernaut 4
18 rezaduty 4
19 István Márton 4
20 LVT-tholv2k 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation