🦸 Calling all superheroes! Introducing the WordPress Superhero Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities! Through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200. Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Unconfirmed < 1.2.5 - Reflected Cross-Site Scripting

7.1

CVE-2014-100018

Apr 11, 2014

Researcher: Mallory Adams

FunCaptcha – Anti-Spam CAPTCHA < 0.3.3 - Cross-Site Request Forgery

8.8

CVE ID Unknown

Apr 11, 2014

Researchers:

Lazyest Gallery < 1.1.21 - Stored Cross-Site Scripting

6.4

CVE-2014-2333

Apr 10, 2014

Researcher: Daniel Marques

WordPress Core < 3.8.2 - SQL Injection

7.2

CVE ID Unknown

Apr 9, 2014

Researcher: Tom Adams

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery

9.6

CVE-2014-2579

Apr 9, 2014

Researcher: High-Tech Bridge Security Research Lab

Twitget < 3.3.3 - Cross-Site Request Forgery

6.3

CVE-2014-2559

Apr 8, 2014

Researcher: Mallory Adams

WordPress Core < 3.8.2 - Contributor Users Can Publish Posts

4.3

CVE-2014-0165

Apr 8, 2014

Researcher: edik

WordPress Core < 3.8.2 - Authentication Cookie Forgery

6.5

CVE-2014-0166

Apr 8, 2014

Researcher: Jon Cave

WP Customer Reviews <= 3.0.8 - Cross-Site Request Forgery

8.8

CVE-2016-10902

Apr 4, 2014

Researchers:

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Cross-Site Request Forgery

5.4

CVE-2014-2340

Apr 2, 2014

Researcher: High-Tech Bridge Security Research Lab

5 Star (Unspecified Version) - Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVE ID Unknown

Mar 31, 2014

Researcher: Jje Incovers

JS Multi Hotel <= 2.2.1 - Full Path Disclosure

5.3

CVE-2014-100009

Mar 31, 2014

Researcher: Eugene Dokukin

Real Estate by Templatic (Unknown Version) - Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVE ID Unknown

Mar 31, 2014

Researcher: Jje Incovers

JS Multi Hotel <= 2.2.1 - Cross-Site Scripting

6.1

CVE-2014-100008

Mar 31, 2014

Researcher: Eugene Dokukin

Nightlife Theme (All Known Versions) - Arbitrary File Upload

9.8

CVE ID Unknown

Mar 31, 2014

Researcher: Jje Incovers

Specialist (Unspecified Version) - Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVE ID Unknown

Mar 31, 2014

Researcher: Jje Incovers

JS Multi Hotel <= 2.2.1 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

Mar 29, 2014

Researcher: Eugene Dokukin

WP Business intelligence lite < 1.3 - Arbitrary File Upload

9.8

CVE ID Unknown

Mar 28, 2014

Researcher: Manish Kishan Tanwar

Ajax Pagination (twitter Style) <= 1.1 - Local File Inclusion

9.8

CVE-2014-2674

Mar 28, 2014

Researcher: Glyn Wintle

GD Star Rating <= 1.9.22 - Cross-Site Request Forgery

8.8

CVE-2014-2838

Mar 28, 2014

Researcher: Tom Adams

Title	CVE ID	CVSS	Researchers	Date
Unconfirmed < 1.2.5 - Reflected Cross-Site Scripting	CVE-2014-100018	7.1	Mallory Adams	April 11, 2014
FunCaptcha – Anti-Spam CAPTCHA < 0.3.3 - Cross-Site Request Forgery		8.8		April 11, 2014
Lazyest Gallery < 1.1.21 - Stored Cross-Site Scripting	CVE-2014-2333	6.4	Daniel Marques	April 10, 2014
WordPress Core < 3.8.2 - SQL Injection		7.2	Tom Adams	April 9, 2014
Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery	CVE-2014-2579	9.6	High-Tech Bridge Security Research Lab	April 9, 2014
Twitget < 3.3.3 - Cross-Site Request Forgery	CVE-2014-2559	6.3	Mallory Adams	April 8, 2014
WordPress Core < 3.8.2 - Contributor Users Can Publish Posts	CVE-2014-0165	4.3	edik	April 8, 2014
WordPress Core < 3.8.2 - Authentication Cookie Forgery	CVE-2014-0166	6.5	Jon Cave	April 8, 2014
WP Customer Reviews <= 3.0.8 - Cross-Site Request Forgery	CVE-2016-10902	8.8		April 4, 2014
Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Cross-Site Request Forgery	CVE-2014-2340	5.4	High-Tech Bridge Security Research Lab	April 2, 2014
5 Star (Unspecified Version) - Cross-Site Request Forgery to Arbitrary File Upload		8.8	Jje Incovers	March 31, 2014
JS Multi Hotel <= 2.2.1 - Full Path Disclosure	CVE-2014-100009	5.3	Eugene Dokukin	March 31, 2014
Real Estate by Templatic (Unknown Version) - Cross-Site Request Forgery to Arbitrary File Upload		8.8	Jje Incovers	March 31, 2014
JS Multi Hotel <= 2.2.1 - Cross-Site Scripting	CVE-2014-100008	6.1	Eugene Dokukin	March 31, 2014
Nightlife Theme (All Known Versions) - Arbitrary File Upload		9.8	Jje Incovers	March 31, 2014
Specialist (Unspecified Version) - Cross-Site Request Forgery to Arbitrary File Upload		8.8	Jje Incovers	March 31, 2014
JS Multi Hotel <= 2.2.1 - Reflected Cross-Site Scripting		6.1	Eugene Dokukin	March 29, 2014
WP Business intelligence lite < 1.3 - Arbitrary File Upload		9.8	Manish Kishan Tanwar	March 28, 2014
Ajax Pagination (twitter Style) <= 1.1 - Local File Inclusion	CVE-2014-2674	9.8	Glyn Wintle	March 28, 2014
GD Star Rating <= 1.9.22 - Cross-Site Request Forgery	CVE-2014-2838	8.8	Tom Adams	March 28, 2014

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 20, 2024 Vulns
1	stealthcopter	25
2	wesley (wcraft)	21
3	Francesco Carlucci	20
4	Lucio Sá	19
5	Daniel Ruf	16
6	vgo0	15
7	Rafie Muhammad	12
8	Dave Jong	11
9	Ananda Dhakal	9
10	Marco Wotschka	8
11	Muhammad Daffa	6
12	Peter Thaleikis	6
13	Krzysztof Zając	6
14	Fariq Fadillah Gusti Insani (fariqfgi)	5
15	Bob Matyas	5
16	Le Ngoc Anh	5
17	Webbernaut	5
18	João Pedro Soares de Alcântara	5
19	István Márton	4
20	LVT-tholv2k	4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation