WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
myCred <= 2.5 - Cross-Site Request Forgery
4.3
CVE-2023-35096
Jun 14, 2023
Researcher: István Márton
Stock Manager for WooCommerce <= 2.10.0 - Cross-Site Request Forgery
4.3
CVE-2023-35091
Jun 14, 2023
Researcher: Nguyen Xuan Chien
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
4.3
CVE-2023-3199
Jun 13, 2023
Researcher: Truoc Phan
MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update
4.3
CVE-2023-3202
Jun 13, 2023
Researcher: Truoc Phan
WP PDF Generator <= 1.2.2 - Cross-Site Request Forgery to PDF Settings Update
4.3
CVE-2023-35038
Jun 13, 2023
Researcher: Mika
Zephyr Project Manager <= 3.3.93 - Cross-Site Request Forgery
4.3
CVE-2023-34373
Jun 13, 2023
Researcher: Theodoros Malachias
MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update
4.3
CVE-2023-3203
Jun 13, 2023
Researcher: Truoc Phan
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update
4.3
CVE-2023-3200
Jun 13, 2023
Researcher: Truoc Phan
Securimage-WP <= 3.6.16 - Cross-Site Request Forgery
4.3
CVE-2023-35044
Jun 13, 2023
Researcher: Abdi Pranata
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update
4.3
CVE-2023-3198
Jun 13, 2023
Researcher: Truoc Phan
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
4.3
CVE-2023-3201
Jun 13, 2023
Researcher: Truoc Phan
WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action
4.3
CVE-2023-2563
Jun 12, 2023
Researcher: Marco Wotschka
Download Monitor <= 4.7.60 - Missing Authorization to Authenticated Data Export
4.3
CVE ID Unknown
Jun 9, 2023
Researchers:
WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update
4.3
CVE-2023-2869
Jun 8, 2023
Researcher: Marco Wotschka
Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Cross-Site Request Forgery via toggle_widget
4.3
CVE-2023-1807
Jun 8, 2023
Researcher: Alex Thomas
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
4.3
CVE-2023-0692
Jun 8, 2023
Researcher: Ram
Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Missing Authorization in toggle_widget
4.3
CVE-2023-2189
Jun 8, 2023
Researcher: Alex Thomas
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode
4.3
CVE-2023-0691
Jun 8, 2023
Researcher: Ram
Easy Digital Downloads <= 3.1.1.4.2 - Cross-Site Request Forgery via edd_trigger_upgrades
4.3
CVE ID Unknown
Jun 7, 2023
Researchers:
Getwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint
4.3
CVE-2023-1910
Jun 6, 2023
Researcher: Ram
Title CVE ID CVSS Researchers Date
myCred <= 2.5 - Cross-Site Request Forgery CVE-2023-35096 4.3 István Márton June 14, 2023
Stock Manager for WooCommerce <= 2.10.0 - Cross-Site Request Forgery CVE-2023-35091 4.3 Nguyen Xuan Chien June 14, 2023
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update CVE-2023-3199 4.3 Truoc Phan June 13, 2023
MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update CVE-2023-3202 4.3 Truoc Phan June 13, 2023
WP PDF Generator <= 1.2.2 - Cross-Site Request Forgery to PDF Settings Update CVE-2023-35038 4.3 Mika June 13, 2023
Zephyr Project Manager <= 3.3.93 - Cross-Site Request Forgery CVE-2023-34373 4.3 Theodoros Malachias June 13, 2023
MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update CVE-2023-3203 4.3 Truoc Phan June 13, 2023
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update CVE-2023-3200 4.3 Truoc Phan June 13, 2023
Securimage-WP <= 3.6.16 - Cross-Site Request Forgery CVE-2023-35044 4.3 Abdi Pranata June 13, 2023
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update CVE-2023-3198 4.3 Truoc Phan June 13, 2023
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update CVE-2023-3201 4.3 Truoc Phan June 13, 2023
WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action CVE-2023-2563 4.3 Marco Wotschka June 12, 2023
Download Monitor <= 4.7.60 - Missing Authorization to Authenticated Data Export 4.3 June 9, 2023
WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update CVE-2023-2869 4.3 Marco Wotschka June 8, 2023
Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Cross-Site Request Forgery via toggle_widget CVE-2023-1807 4.3 Alex Thomas June 8, 2023
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode CVE-2023-0692 4.3 Ram June 8, 2023
Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Missing Authorization in toggle_widget CVE-2023-2189 4.3 Alex Thomas June 8, 2023
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode CVE-2023-0691 4.3 Ram June 8, 2023
Easy Digital Downloads <= 3.1.1.4.2 - Cross-Site Request Forgery via edd_trigger_upgrades 4.3 June 7, 2023
Getwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint CVE-2023-1910 4.3 Ram June 6, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 20, 2024
Vulns
1 stealthcopter 25
2 wesley (wcraft) 21
3 Francesco Carlucci 20
4 Lucio Sá 19
5 Daniel Ruf 16
6 vgo0 15
7 Rafie Muhammad 12
8 Dave Jong 11
9 Ananda Dhakal 9
10 Marco Wotschka 8
11 Muhammad Daffa 6
12 Peter Thaleikis 6
13 Krzysztof Zając 6
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Bob Matyas 5
16 Le Ngoc Anh 5
17 Webbernaut 5
18 João Pedro Soares de Alcântara 5
19 István Márton 4
20 LVT-tholv2k 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation