WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
SEUR Oficial < 1.7.2 - Authenticated Arbitrary File Download
4.9
CVE-2021-25004
Jan 10, 2022
Researcher: José Aguilera
CAOS <= 4.1.8 - Admin+ Arbitrary Folder Deletion via Path Traversal
4.9
CVE-2021-25020
Dec 1, 2021
Researcher: José Aguilera
OMGF <= 4.5.11 - Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
4.9
CVE-2021-25021
Dec 1, 2021
Researcher: José Aguilera
Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read
4.9
CVE-2021-24689
Sep 27, 2021
Researcher: Davide Taraschi
AceIDE <= 2.6.2 - Authenticated (Admin+) Arbitrary File Read
4.9
CVE-2021-24549
Jul 24, 2021
Researcher: Shreya Pohekar
Photo Gallery <= 1.5.74 - File Upload Path Traversal
4.9
CVE-2021-24363
Jul 18, 2021
Researcher: avolume
Haxcan <= 1.0.0 - Authenticated (Admin+) Path Traversal to Arbitrary File Read
4.9
CVE ID Unknown
Jul 5, 2021
Researcher: WPScanTeam
Theme Editor <= 2.5 - Authenticated Arbitrary File Download
4.9
CVE-2021-24154
Feb 13, 2021
Researcher: Nguyen Van Khanh
Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection
4.9
CVE-2020-5768
Jul 16, 2020
Researcher: Alex Peña
Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure
4.9
CVE-2020-36835
Mar 23, 2020
Researcher: WebARX Security
Photo Gallery by 10Web <= 1.5.24 - Authenticated Local File Inclusion
4.9
CVE-2019-14798
May 15, 2019
Researchers:
WordPress Core < 4.8.2 - Directory Traversal via Customizer
4.9
CVE-2017-14722
Sep 19, 2017
Researcher: Weston Ruter
Newsletters <= 4.6.4.2 - Directory Traversal
4.9
CVE ID Unknown
May 29, 2017
Researcher: Neven Birusk
WordPress Core < 4.7.3 - Arbitrary File Deletion
4.9
CVE-2017-6816
Mar 6, 2017
Researchers: TrigInc, xuliang
W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download
4.9
CVE ID Unknown
Sep 26, 2016
Researcher: SecuPress
WP Fastest Cache <= 0.8.5.7 - Missing Authorization
4.9
CVE ID Unknown
May 23, 2016
Researcher: Panagiotis Vagenas
Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure
4.9
CVE ID Unknown
Feb 25, 2016
Researcher: Oliver Liu
Font <= 7.5 - Path Traversal
4.9
CVE-2015-7683
Oct 12, 2015
Researchers:
TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Directory Traversal
4.9
CVE-2015-3301
Apr 29, 2015
Researcher: High-Tech Bridge Security Research Lab
IP Blacklist Cloud < 3.43 - Directory Traversal
4.9
CVE ID Unknown
Mar 13, 2015
Researcher: James Hooker
Title CVE ID CVSS Researchers Date
SEUR Oficial < 1.7.2 - Authenticated Arbitrary File Download CVE-2021-25004 4.9 José Aguilera January 10, 2022
CAOS <= 4.1.8 - Admin+ Arbitrary Folder Deletion via Path Traversal CVE-2021-25020 4.9 José Aguilera December 1, 2021
OMGF <= 4.5.11 - Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal CVE-2021-25021 4.9 José Aguilera December 1, 2021
Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read CVE-2021-24689 4.9 Davide Taraschi September 27, 2021
AceIDE <= 2.6.2 - Authenticated (Admin+) Arbitrary File Read CVE-2021-24549 4.9 Shreya Pohekar July 24, 2021
Photo Gallery <= 1.5.74 - File Upload Path Traversal CVE-2021-24363 4.9 avolume July 18, 2021
Haxcan <= 1.0.0 - Authenticated (Admin+) Path Traversal to Arbitrary File Read 4.9 WPScanTeam July 5, 2021
Theme Editor <= 2.5 - Authenticated Arbitrary File Download CVE-2021-24154 4.9 Nguyen Van Khanh February 13, 2021
Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection CVE-2020-5768 4.9 Alex Peña July 16, 2020
Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure CVE-2020-36835 4.9 WebARX Security March 23, 2020
Photo Gallery by 10Web <= 1.5.24 - Authenticated Local File Inclusion CVE-2019-14798 4.9 May 15, 2019
WordPress Core < 4.8.2 - Directory Traversal via Customizer CVE-2017-14722 4.9 Weston Ruter September 19, 2017
Newsletters <= 4.6.4.2 - Directory Traversal 4.9 Neven Birusk May 29, 2017
WordPress Core < 4.7.3 - Arbitrary File Deletion CVE-2017-6816 4.9 TrigInc, xuliang March 6, 2017
W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download 4.9 SecuPress September 26, 2016
WP Fastest Cache <= 0.8.5.7 - Missing Authorization 4.9 Panagiotis Vagenas May 23, 2016
Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure 4.9 Oliver Liu February 25, 2016
Font <= 7.5 - Path Traversal CVE-2015-7683 4.9 October 12, 2015
TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Directory Traversal CVE-2015-3301 4.9 High-Tech Bridge Security Research Lab April 29, 2015
IP Blacklist Cloud < 3.43 - Directory Traversal 4.9 James Hooker March 13, 2015
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Oct 2, 2024
Vulns
1 Francesco Carlucci 53
2 João Pedro Soares de Alcântara 52
3 István Márton 50
4 stealthcopter 46
5 vgo0 43
6 SOPROBRO 33
7 Mika 32
8 Peter Thaleikis 27
9 theviper17y 18
10 Trương Hữu Phúc (truonghuuphuc) 16
11 LVT-tholv2k 15
12 Rafie Muhammad 14
13 wesley (wcraft) 12
14 Colin Xu 10
15 Le Ngoc Anh 9
16 Hakiduck 9
17 Joshua Chan 8
18 Ankit Patel 8
19 Webbernaut 7
20 Robert DeVore 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation