🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

WP Ultimate Email Marketer <= 1.2.0 - Authentication Bypass

9.8

CVE-2013-3264

Sep 24, 2013

Researcher: Han Lee

NOSpamPTI <= 2.1 - SQL Injection

9.8

CVE-2013-5917

Sep 20, 2013

Researcher: Alexandro Silva

RokIntroScroller <= 1.8 - Arbitrary File Upload

9.8

CVE ID Unknown

Sep 19, 2013

Researcher: Eugene Dokukin

RokNewsPager <= 1.17 - Arbitrary File Upload

9.8

CVE ID Unknown

Sep 17, 2013

Researcher: Eugene Dokukin

Complete Gallery Manager <= 3.3.3 - Arbitrary File Upload

9.8

CVE-2013-5962

Sep 17, 2013

Researcher: Fuad Pilus

RokStories <= 1.25 - Arbitrary File Upload

9.8

CVE ID Unknown

Sep 17, 2013

Researcher: Eugene Dokukin

Simple Dropbox Upload < 1.8.8.1 - Arbitrary File Upload

9.8

CVE-2013-5963

Sep 14, 2013

Researcher: Amirh03in

Mukioplayer For WordPress <= 1.6 - SQL injection

9.8

CVE ID Unknown

Sep 13, 2013

Researcher: Amirh03in

Testimonial < 2.3 - SQL Injection

9.8

CVE-2013-5673

Sep 1, 2013

Researcher: Adéla Goldová

Testimonial < 2.3 - Multiple Vulnerabilities

9.8

CVE ID Unknown

Sep 1, 2013

Researcher: Adéla Goldová

JS Restaurant (All Versions) - SQL Injection

9.8

CVE ID Unknown

Jul 8, 2013

Researcher: T3rm!nat0r5

RokMicroNews <= 1.5 - Multiple Vulnerabilities

9.8

CVE ID Unknown

Jul 2, 2013

Researcher: Eugene Dokukin

WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload

9.8

CVE-2013-3684

Jun 13, 2013

Researcher: Marcos Agüero

Flagallery-skins <= 1.1.5 - SQL Injection

9.8

CVE ID Unknown

May 22, 2013

Researcher: Amirh03in

WordPress Video Gallery < 2.1 - SQL Injection

9.8

CVE-2013-3478

May 14, 2013

Researcher: Charlie Eriksen

SpiderVPlayer <= 2.1 - SQL Injection

9.8

CVE-2013-3532

Apr 11, 2013

Researcher: Ashiyane Digital Security Team

Spiffy XSPF Player <= 0.1 - SQL Injection

9.8

CVE-2013-3530

Apr 10, 2013

Researcher: Amirh03in

Social Media Widget <= 4.0 - Arbitrary File Upload

9.8

CVE-2013-1949

Apr 8, 2013

Researchers:

Finalist (All Versions) - SQL Injection

9.8

CVE ID Unknown

Mar 25, 2013

Researcher: Ashiyane Digital Security Team

L4 Shopping Cart Plugin < 8.1.1 - SQL Injection

9.8

CVE ID Unknown

Mar 25, 2013

Researcher: tr0janman

Title	CVE ID	CVSS	Researchers	Date
WP Ultimate Email Marketer <= 1.2.0 - Authentication Bypass	CVE-2013-3264	9.8	Han Lee	September 24, 2013
NOSpamPTI <= 2.1 - SQL Injection	CVE-2013-5917	9.8	Alexandro Silva	September 20, 2013
RokIntroScroller <= 1.8 - Arbitrary File Upload		9.8	Eugene Dokukin	September 19, 2013
RokNewsPager <= 1.17 - Arbitrary File Upload		9.8	Eugene Dokukin	September 17, 2013
Complete Gallery Manager <= 3.3.3 - Arbitrary File Upload	CVE-2013-5962	9.8	Fuad Pilus	September 17, 2013
RokStories <= 1.25 - Arbitrary File Upload		9.8	Eugene Dokukin	September 17, 2013
Simple Dropbox Upload < 1.8.8.1 - Arbitrary File Upload	CVE-2013-5963	9.8	Amirh03in	September 14, 2013
Mukioplayer For WordPress <= 1.6 - SQL injection		9.8	Amirh03in	September 13, 2013
Testimonial < 2.3 - SQL Injection	CVE-2013-5673	9.8	Adéla Goldová	September 1, 2013
Testimonial < 2.3 - Multiple Vulnerabilities		9.8	Adéla Goldová	September 1, 2013
JS Restaurant (All Versions) - SQL Injection		9.8	T3rm!nat0r5	July 8, 2013
RokMicroNews <= 1.5 - Multiple Vulnerabilities		9.8	Eugene Dokukin	July 2, 2013
WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload	CVE-2013-3684	9.8	Marcos Agüero	June 13, 2013
Flagallery-skins <= 1.1.5 - SQL Injection		9.8	Amirh03in	May 22, 2013
WordPress Video Gallery < 2.1 - SQL Injection	CVE-2013-3478	9.8	Charlie Eriksen	May 14, 2013
SpiderVPlayer <= 2.1 - SQL Injection	CVE-2013-3532	9.8	Ashiyane Digital Security Team	April 11, 2013
Spiffy XSPF Player <= 0.1 - SQL Injection	CVE-2013-3530	9.8	Amirh03in	April 10, 2013
Social Media Widget <= 4.0 - Arbitrary File Upload	CVE-2013-1949	9.8		April 8, 2013
Finalist (All Versions) - SQL Injection		9.8	Ashiyane Digital Security Team	March 25, 2013
L4 Shopping Cart Plugin < 8.1.1 - SQL Injection		9.8	tr0janman	March 25, 2013

Submit Vulnerability

«
‹
1
2
...
71
72
73
...
1032
1033
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Oct 29, 2024 Vulns
1	SOPROBRO	246
2	Francesco Carlucci	60
3	João Pedro Soares de Alcântara	55
4	Peter Thaleikis	51
5	Gab	45
6	vgo0	42
7	stealthcopter	42
8	Mika	29
9	LVT-tholv2k	29
10	Tonn	18
11	Arkadiusz Hydzik	13
12	Le Ngoc Anh	12
13	István Márton	12
14	Tieu Pham Trong Nhan	10
15	zer0gh0st	10
16	Joshua Chan	9
17	wesley (wcraft)	9
18	theviper17y	9
19	mikemyers	8
20	Trương Hữu Phúc (truonghuuphuc)	8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation