WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Auto Excerpt everywhere <= 1.5 - Cross-Site Request Forgery
4.3
CVE-2023-46776
Oct 27, 2023
Researcher: Nguyen Xuan Chien
WooHoo Newspaper Magazine Theme <= 2.5.3 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2023-4824
Oct 27, 2023
Researcher: Bob Matyas
WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion
4.3
CVE-2023-5799
Oct 26, 2023
Researcher: Erwan LR
EasyRecipe <= 3.5.3251 - Cross-Site Request Forgery
4.3
CVE-2023-46779
Oct 26, 2023
Researcher: Skalucy
Feather Login Page <= 1.1.3 - Cross-Site Request Forgery
4.3
CVE-2023-46777
Oct 26, 2023
Researcher: Mika
Original texts Yandex WebMaster <= 1.18 - Cross-Site Request Forgery
4.3
CVE-2023-46775
Oct 26, 2023
Researcher: Nguyen Xuan Chien
WP Knowledgebase <= 1.3.4 - Cross-Site Request Forgery
4.3
CVE-2023-5802
Oct 26, 2023
Researcher: Nguyen Xuan Chien
Thumbnail carousel slider <= 1.0 - Cross-Site Request Forgery to Mass Slider Deletion
4.3
CVE-2023-5821
Oct 26, 2023
Researcher: Ala Arfaoui
Current Menu Item for Custom Post Types <= 1.5 - Cross-Site Request Forgery
4.3
CVE-2023-46781
Oct 26, 2023
Researcher: Nguyen Xuan Chien
Auto Limit Posts Reloaded <= 2.5 - Cross-Site Request Forgery
4.3
CVE-2023-46778
Oct 26, 2023
Researcher: Nguyen Xuan Chien
Custom My Account for Woocommerce <= 2.1 - Cross-Site Request Forgery
4.3
CVE-2023-46634
Oct 25, 2023
Researcher: qilin_99
Contact Forms by Cimatti <= 1.6.0 - Cross-Site Request Forgery via accua_forms_list_page_table
4.3
CVE-2023-47230
Oct 25, 2023
Researcher: Nguyen Xuan Chien
Remove Add to Cart WooCommerce <= 1.4.4 - Cross-Site Request Forgery to Settings Modification
4.3
CVE-2023-46629
Oct 25, 2023
Researcher: qilin_99
Ni WooCommerce Sales Report <= 3.7.3 - Missing Authorization via ajax_sales_order
4.3
CVE-2023-32299
Oct 25, 2023
Researcher: Jonas Höbenreich
Export WP Page to Static HTML/CSS <= 2.1.9 - Cross-Site Request Forgery via Multiple AJAX Actions
4.3
CVE-2023-31077
Oct 25, 2023
Researcher: konagash
Autolinks Manager <= 1.10.04 - Cross-Site Request Forgery
4.3
CVE-2023-46625
Oct 25, 2023
Researcher: Skalucy
WP Word Count <= 3.2.4 - Missing Authorization via calculate_statistics
4.3
CVE-2023-46628
Oct 25, 2023
Researcher: Abdi Pranata
Custom Header Images <= 1.2.1 - Cross-Site Request Forgery
4.3
CVE-2023-46636
Oct 25, 2023
Researcher: Nguyen Xuan Chien
Category SEO Meta Tags <= 2.5 - Cross-Site Request Forgery via csmt_admin_options
4.3
CVE-2023-46618
Oct 25, 2023
Researcher: LEE SE HYOUNG
WCP OpenWeather <= 2.5.0 - Cross-Site Request Forgery
4.3
CVE-2023-46638
Oct 25, 2023
Researcher: Mika
Title CVE ID CVSS Researchers Date
Auto Excerpt everywhere <= 1.5 - Cross-Site Request Forgery CVE-2023-46776 4.3 Nguyen Xuan Chien October 27, 2023
WooHoo Newspaper Magazine Theme <= 2.5.3 - Cross-Site Request Forgery to Settings Update CVE-2023-4824 4.3 Bob Matyas October 27, 2023
WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion CVE-2023-5799 4.3 Erwan LR October 26, 2023
EasyRecipe <= 3.5.3251 - Cross-Site Request Forgery CVE-2023-46779 4.3 Skalucy October 26, 2023
Feather Login Page <= 1.1.3 - Cross-Site Request Forgery CVE-2023-46777 4.3 Mika October 26, 2023
Original texts Yandex WebMaster <= 1.18 - Cross-Site Request Forgery CVE-2023-46775 4.3 Nguyen Xuan Chien October 26, 2023
WP Knowledgebase <= 1.3.4 - Cross-Site Request Forgery CVE-2023-5802 4.3 Nguyen Xuan Chien October 26, 2023
Thumbnail carousel slider <= 1.0 - Cross-Site Request Forgery to Mass Slider Deletion CVE-2023-5821 4.3 Ala Arfaoui October 26, 2023
Current Menu Item for Custom Post Types <= 1.5 - Cross-Site Request Forgery CVE-2023-46781 4.3 Nguyen Xuan Chien October 26, 2023
Auto Limit Posts Reloaded <= 2.5 - Cross-Site Request Forgery CVE-2023-46778 4.3 Nguyen Xuan Chien October 26, 2023
Custom My Account for Woocommerce <= 2.1 - Cross-Site Request Forgery CVE-2023-46634 4.3 qilin_99 October 25, 2023
Contact Forms by Cimatti <= 1.6.0 - Cross-Site Request Forgery via accua_forms_list_page_table CVE-2023-47230 4.3 Nguyen Xuan Chien October 25, 2023
Remove Add to Cart WooCommerce <= 1.4.4 - Cross-Site Request Forgery to Settings Modification CVE-2023-46629 4.3 qilin_99 October 25, 2023
Ni WooCommerce Sales Report <= 3.7.3 - Missing Authorization via ajax_sales_order CVE-2023-32299 4.3 Jonas Höbenreich October 25, 2023
Export WP Page to Static HTML/CSS <= 2.1.9 - Cross-Site Request Forgery via Multiple AJAX Actions CVE-2023-31077 4.3 konagash October 25, 2023
Autolinks Manager <= 1.10.04 - Cross-Site Request Forgery CVE-2023-46625 4.3 Skalucy October 25, 2023
WP Word Count <= 3.2.4 - Missing Authorization via calculate_statistics CVE-2023-46628 4.3 Abdi Pranata October 25, 2023
Custom Header Images <= 1.2.1 - Cross-Site Request Forgery CVE-2023-46636 4.3 Nguyen Xuan Chien October 25, 2023
Category SEO Meta Tags <= 2.5 - Cross-Site Request Forgery via csmt_admin_options CVE-2023-46618 4.3 LEE SE HYOUNG October 25, 2023
WCP OpenWeather <= 2.5.0 - Cross-Site Request Forgery CVE-2023-46638 4.3 Mika October 25, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 22, 2024
Vulns
1 stealthcopter 24
2 Francesco Carlucci 20
3 wesley (wcraft) 19
4 Lucio Sá 17
5 vgo0 15
6 Rafie Muhammad 11
7 Dave Jong 10
8 Ananda Dhakal 9
9 Marco Wotschka 8
10 Daniel Ruf 7
11 Muhammad Daffa 6
12 Krzysztof Zając 6
13 João Pedro Soares de Alcântara 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Le Ngoc Anh 5
16 Peter Thaleikis 4
17 LVT-tholv2k 4
18 Webbernaut 4
19 István Márton 4
20 rezaduty 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation