WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
One Click Plugin Updater <= 2.4.14 - Cross-Site Request Forgery to Settings Update
9.6
CVE-2022-1791
May 23, 2022
Researcher: Daniel Ruf
HC Custom WP-Admin URL <= 1.4 - Cross-Site Request Forgery
9.6
CVE-2022-1594
May 18, 2022
Researcher: Daniel Ruf
Hot Linked Image Cacher <= 1.16 - Cross-Site Request Forgery
9.6
CVE-2022-1765
May 17, 2022
Researcher: Daniel Ruf
Post Snippets <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
9.6
CVE-2021-25010
Jan 31, 2022
Researcher: Muhammad Adel
All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection
9.6
CVE-2021-25037
Dec 14, 2021
Researcher: Marc-Alexandre Montpas
Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting
9.6
CVE-2021-24229
Mar 26, 2021
Researchers: George Stephanis, Fioravante Souza, Miguel Neto, Benedict Singer, Marc-Alexandre Montpas
Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting
9.6
CVE-2021-24228
Mar 26, 2021
Researchers: George Stephanis, Fioravante Souza, Miguel Neto, Benedict Singer, Marc-Alexandre Montpas
WP Armour Honeypot Anti Spam <= 1.5.6 -Cross-Site Request Forgery to Arbitrary Options Update
9.6
CVE ID Unknown
Feb 8, 2021
Researchers:
Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting
9.6
CVE-2021-24884
Jan 28, 2021
Researcher: Maximilian Barz
ND Booking <= 2.4 - Unauthenticated Arbitrary Options Update
9.6
CVE-2019-15774
Aug 5, 2019
Researcher: Jerome Bruandet
WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
9.6
CVE-2019-9787
Apr 12, 2019
Researcher: Simon Scannell
Captcha 4.3.6 - 4.4.4 - Plugin Backdoor
9.6
CVE ID Unknown
Dec 19, 2017
Researcher: Matt Barry
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection
9.6
CVE ID Unknown
Apr 26, 2017
Researchers:
EWWW Image Optimizer <= 2.8.4 - Remote Code Execution
9.6
CVE-2016-20010
Jun 8, 2016
Researcher: Sean Murphy
WordPress Core < 4.2.4 - Cross-Site Request Forgery to Post Lockage
9.6
CVE-2015-5731
Aug 4, 2015
Researcher: Mohamed A. Baset
WP Fast Cache <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting
9.6
CVE ID Unknown
May 11, 2015
Researcher: Claudio Viviani
Pods <= 2.4.3 - Multiple Cross-Site Request Forgery
9.6
CVE-2014-7957
Jan 12, 2015
Researcher: Pietro Oliva
Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery
9.6
CVE-2014-2579
Apr 9, 2014
Researcher: High-Tech Bridge Security Research Lab
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read
9.4
CVE ID Unknown
May 13, 2019
Researcher: Antony Garand
WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgery
9.3
CVE-2024-5021
Jun 18, 2024
Researcher: Francesco Carlucci
Title CVE ID CVSS Researchers Date
One Click Plugin Updater <= 2.4.14 - Cross-Site Request Forgery to Settings Update CVE-2022-1791 9.6 Daniel Ruf May 23, 2022
HC Custom WP-Admin URL <= 1.4 - Cross-Site Request Forgery CVE-2022-1594 9.6 Daniel Ruf May 18, 2022
Hot Linked Image Cacher <= 1.16 - Cross-Site Request Forgery CVE-2022-1765 9.6 Daniel Ruf May 17, 2022
Post Snippets <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2021-25010 9.6 Muhammad Adel January 31, 2022
All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection CVE-2021-25037 9.6 Marc-Alexandre Montpas December 14, 2021
Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting CVE-2021-24229 9.6 George Stephanis, Fioravante Souza, Miguel Neto, Benedict Singer, Marc-Alexandre Montpas March 26, 2021
Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting CVE-2021-24228 9.6 George Stephanis, Fioravante Souza, Miguel Neto, Benedict Singer, Marc-Alexandre Montpas March 26, 2021
WP Armour Honeypot Anti Spam <= 1.5.6 -Cross-Site Request Forgery to Arbitrary Options Update 9.6 February 8, 2021
Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting CVE-2021-24884 9.6 Maximilian Barz January 28, 2021
ND Booking <= 2.4 - Unauthenticated Arbitrary Options Update CVE-2019-15774 9.6 Jerome Bruandet August 5, 2019
WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments CVE-2019-9787 9.6 Simon Scannell April 12, 2019
Captcha 4.3.6 - 4.4.4 - Plugin Backdoor 9.6 Matt Barry December 19, 2017
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection 9.6 April 26, 2017
EWWW Image Optimizer <= 2.8.4 - Remote Code Execution CVE-2016-20010 9.6 Sean Murphy June 8, 2016
WordPress Core < 4.2.4 - Cross-Site Request Forgery to Post Lockage CVE-2015-5731 9.6 Mohamed A. Baset August 4, 2015
WP Fast Cache <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting 9.6 Claudio Viviani May 11, 2015
Pods <= 2.4.3 - Multiple Cross-Site Request Forgery CVE-2014-7957 9.6 Pietro Oliva January 12, 2015
Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery CVE-2014-2579 9.6 High-Tech Bridge Security Research Lab April 9, 2014
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read 9.4 Antony Garand May 13, 2019
WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgery CVE-2024-5021 9.3 Francesco Carlucci June 18, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 26, 2024
Vulns
1 stealthcopter 26
2 Francesco Carlucci 26
3 wesley (wcraft) 23
4 vgo0 22
5 Lucio Sá 19
6 Daniel Ruf 11
7 Krzysztof Zając 10
8 Peter Thaleikis 7
9 Webbernaut 7
10 Marco Wotschka 7
11 Le Ngoc Anh 5
12 Muhammad Daffa 5
13 Fariq Fadillah Gusti Insani (fariqfgi) 4
14 rezaduty 4
15 István Márton 4
16 Rafie Muhammad 3
17 Sharanabasappa 3
18 Robert DeVore 3
19 LVT-tholv2k 3
20 Rasoul Jahanshahi 3

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation