🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Flipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection

8.8

CVE-2024-6152

Jul 26, 2024

Researcher: Francesco Carlucci

Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVE-2024-6431

Jul 26, 2024

Researcher: István Márton

PowerPack Pro for Elementor <= 2.10.14 - Authenticated (Contributor+) Privilege Escalation

8.8

CVE-2024-39634

Jul 24, 2024

Researcher: Rafie Muhammad

PowerPack for Beaver Builder <= 2.33.0 - Authenticated (Contributor+) Privilege Escalation

8.8

CVE-2024-39633

Jul 24, 2024

Researcher: Rafie Muhammad

LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion

8.8

CVE-2024-6589

Jul 24, 2024

Researcher: stealthcopter

Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload

8.8

CVE-2024-6756

Jul 23, 2024

Researcher: István Márton

ListingPro <= 2.9.3 - Authenticated (Subscriber+) Local File Inclusion

8.8

CVE-2024-39624

Jul 22, 2024

Researcher: Rafie Muhammad

ListingPro <= 2.9.3 - Cross-Site Request Forgery to Account Takeover

8.8

CVE-2024-39623

Jul 22, 2024

Researcher: Rafie Muhammad

Best Restaurant Menu by PriceListo <= 1.4.1 - Authenticated (Contributor+) SQL Injection

8.8

CVE-2024-38793

Jul 22, 2024

Researcher: Jayden Caelli

SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter

8.8

CVE-2024-6497

Jul 19, 2024

Researcher: bart

JetWidgets for Elementor and WooCommerce <= 1.1.7 - Authenticated (Contributor+) Limited Local File Inclusion

8.8

CVE-2024-38772

Jul 19, 2024

Researcher: João Pedro Soares de Alcântara

FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter

8.8

CVE-2024-6338

Jul 18, 2024

Researcher: Arkadiusz Hydzik

Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload

8.8

CVE-2024-3242

Jul 17, 2024

Researcher: stealthcopter

Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection

8.8

CVE-2024-5726

Jul 17, 2024

Researcher: Francesco Carlucci

BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload

8.8

CVE-2024-6660

Jul 16, 2024

Researcher: shaman0x01

The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) <= 2.0.8.6 - Authenticated (contributor+) Local File Inclusion

8.8

CVE-2024-38768

Jul 16, 2024

Researcher: João Pedro Soares de Alcântara

BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation

8.8

CVE-2024-6467

Jul 16, 2024

Researcher: Arkadiusz Hydzik

Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'

8.8

CVE-2024-6353

Jul 11, 2024

Researcher: 1337_Wannabe

Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data

8.8

CVE-2024-5325

Jul 11, 2024

Researcher: Peter Thaleikis

ExS Widgets <= 0.3.1 - Authenticated (Contributor+) Local File Inclusion

8.8

CVE-2024-38715

Jul 11, 2024

Researcher: João Pedro Soares de Alcântara

Title	CVE ID	CVSS	Researchers	Date
Flipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection	CVE-2024-6152	8.8	Francesco Carlucci	July 26, 2024
Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload	CVE-2024-6431	8.8	István Márton	July 26, 2024
PowerPack Pro for Elementor <= 2.10.14 - Authenticated (Contributor+) Privilege Escalation	CVE-2024-39634	8.8	Rafie Muhammad	July 24, 2024
PowerPack for Beaver Builder <= 2.33.0 - Authenticated (Contributor+) Privilege Escalation	CVE-2024-39633	8.8	Rafie Muhammad	July 24, 2024
LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion	CVE-2024-6589	8.8	stealthcopter	July 24, 2024
Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload	CVE-2024-6756	8.8	István Márton	July 23, 2024
ListingPro <= 2.9.3 - Authenticated (Subscriber+) Local File Inclusion	CVE-2024-39624	8.8	Rafie Muhammad	July 22, 2024
ListingPro <= 2.9.3 - Cross-Site Request Forgery to Account Takeover	CVE-2024-39623	8.8	Rafie Muhammad	July 22, 2024
Best Restaurant Menu by PriceListo <= 1.4.1 - Authenticated (Contributor+) SQL Injection	CVE-2024-38793	8.8	Jayden Caelli	July 22, 2024
SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter	CVE-2024-6497	8.8	bart	July 19, 2024
JetWidgets for Elementor and WooCommerce <= 1.1.7 - Authenticated (Contributor+) Limited Local File Inclusion	CVE-2024-38772	8.8	João Pedro Soares de Alcântara	July 19, 2024
FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter	CVE-2024-6338	8.8	Arkadiusz Hydzik	July 18, 2024
Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload	CVE-2024-3242	8.8	stealthcopter	July 17, 2024
Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection	CVE-2024-5726	8.8	Francesco Carlucci	July 17, 2024
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload	CVE-2024-6660	8.8	shaman0x01	July 16, 2024
The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) <= 2.0.8.6 - Authenticated (contributor+) Local File Inclusion	CVE-2024-38768	8.8	João Pedro Soares de Alcântara	July 16, 2024
BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation	CVE-2024-6467	8.8	Arkadiusz Hydzik	July 16, 2024
Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'	CVE-2024-6353	8.8	1337_Wannabe	July 11, 2024
Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data	CVE-2024-5325	8.8	Peter Thaleikis	July 11, 2024
ExS Widgets <= 0.3.1 - Authenticated (Contributor+) Local File Inclusion	CVE-2024-38715	8.8	João Pedro Soares de Alcântara	July 11, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 28, 2024 Vulns
1	Francesco Carlucci	33
2	vgo0	24
3	stealthcopter	23
4	wesley (wcraft)	23
5	Lucio Sá	14
6	Krzysztof Zając	9
7	Webbernaut	7
8	Marco Wotschka	7
9	Peter Thaleikis	6
10	TANG Cheuk Hei (siunam)	5
11	Daniel Ruf	5
12	rezaduty	5
13	zer0gh0st	4
14	LVT-tholv2k	3
15	Rafie Muhammad	3
16	Le Ngoc Anh	3
17	Robert DeVore	3
18	João Pedro Soares de Alcântara	3
19	Arkadiusz Hydzik	2
20	Peng Zhou	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation