WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets
8.8
CVE-2024-2385
Jul 3, 2024
Researcher: wesley (wcraft)
Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets
6.4
CVE-2024-3638
Jul 3, 2024
Researcher: Webbernaut
Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets
6.4
CVE-2024-2926
Jul 3, 2024
Researcher: wesley (wcraft)
IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'
8.8
CVE-2024-6319
Jul 3, 2024
Researcher: István Márton
IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'
8.8
CVE-2024-6318
Jul 3, 2024
Researcher: István Márton
Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid
6.4
CVE-2024-3639
Jul 3, 2024
Researcher: Ngô Thiên An (ancorn_)
One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-5641
Jul 3, 2024
Researcher: Lucio Sá
Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service
3.1
CVE-2024-6434
Jul 3, 2024
Researcher: Muhammad Umer Adeem (Yldrm)
WP ULike <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-6094
Jul 3, 2024
Researcher: Dmitrii Ignatyev
Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
6.4
CVE-2024-6340
Jul 2, 2024
Researcher: Webbernaut
The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
6.4
CVE-2024-4482
Jul 2, 2024
Researcher: wesley (wcraft)
Request a Quote <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-6231
Jul 2, 2024
Researcher: Bob Matyas
WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
6.4
CVE-2024-6263
Jul 2, 2024
Researcher: Webbernaut
LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type'
5.4
CVE-2024-37479
Jul 2, 2024
Researcher: João Pedro Soares de Alcântara
Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery
4.3
CVE-2024-4543
Jul 2, 2024
Researcher: Benedictus Jovan (aillesiM)
Page Builder Gutenberg Blocks – CoBlocks <= 3.1.11 - Authenticated (Contributor+) Server-Side Request Forgery
4.3
CVE-2024-4260
Jul 2, 2024
Researcher: Dmitrii Ignatyev
Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure
5.3
CVE-2024-6420
Jul 2, 2024
Researcher: Juan Pablo Gomez Postigo
Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks
6.4
CVE-2024-4268
Jul 1, 2024
Researcher: Webbernaut
Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter
6.4
CVE-2024-5260
Jul 1, 2024
Researcher: stealthcopter
Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute
6.4
CVE-2024-3513
Jul 1, 2024
Researchers: João Pedro Soares de Alcântara, Dmitrii Ignatyev
Title CVE ID CVSS Researchers Date
Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets CVE-2024-2385 8.8 wesley (wcraft) July 3, 2024
Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets CVE-2024-3638 6.4 Webbernaut July 3, 2024
Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets CVE-2024-2926 6.4 wesley (wcraft) July 3, 2024
IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload' CVE-2024-6319 8.8 István Márton July 3, 2024
IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file' CVE-2024-6318 8.8 István Márton July 3, 2024
Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid CVE-2024-3639 6.4 Ngô Thiên An (ancorn_) July 3, 2024
One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-5641 6.4 Lucio Sá July 3, 2024
Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service CVE-2024-6434 3.1 Muhammad Umer Adeem (Yldrm) July 3, 2024
WP ULike <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-6094 4.4 Dmitrii Ignatyev July 3, 2024
Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVE-2024-6340 6.4 Webbernaut July 2, 2024
The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVE-2024-4482 6.4 wesley (wcraft) July 2, 2024
Request a Quote <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-6231 4.4 Bob Matyas July 2, 2024
WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVE-2024-6263 6.4 Webbernaut July 2, 2024
LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' CVE-2024-37479 5.4 João Pedro Soares de Alcântara July 2, 2024
Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery CVE-2024-4543 4.3 Benedictus Jovan (aillesiM) July 2, 2024
Page Builder Gutenberg Blocks – CoBlocks <= 3.1.11 - Authenticated (Contributor+) Server-Side Request Forgery CVE-2024-4260 4.3 Dmitrii Ignatyev July 2, 2024
Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure CVE-2024-6420 5.3 Juan Pablo Gomez Postigo July 2, 2024
Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks CVE-2024-4268 6.4 Webbernaut July 1, 2024
Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter CVE-2024-5260 6.4 stealthcopter July 1, 2024
Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute CVE-2024-3513 6.4 João Pedro Soares de Alcântara, Dmitrii Ignatyev July 1, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 25, 2024
Vulns
1 Francesco Carlucci 27
2 stealthcopter 27
3 wesley (wcraft) 26
4 vgo0 22
5 Lucio Sá 19
6 Daniel Ruf 11
7 Rafie Muhammad 11
8 Dave Jong 10
9 Krzysztof Zając 10
10 Ananda Dhakal 9
11 Peter Thaleikis 7
12 Le Ngoc Anh 7
13 Webbernaut 7
14 Marco Wotschka 7
15 João Pedro Soares de Alcântara 7
16 Muhammad Daffa 6
17 LVT-tholv2k 5
18 Fariq Fadillah Gusti Insani (fariqfgi) 5
19 István Márton 4
20 João G. Barbosa (4rCanJ0x!) 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation