WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference
4.3
CVE-2022-3995
Oct 31, 2022
Researcher: Marco Wotschka
Appointment Booking Calendar <= 1.3.69 - Missing Authorization
4.3
CVE-2022-43482
Oct 30, 2022
Researcher: István Márton
Appointment Hour Booking <= 1.3.71 - Missing Authorization
4.3
CVE-2022-41692
Oct 30, 2022
Researcher: István Márton
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
4.3
CVE-2022-3361
Oct 28, 2022
Researcher: Ruijie Li
Syncee – Global Dropshipping <= 1.0.9 - Missing Authorization.
4.3
CVE-2022-3694
Oct 27, 2022
Researcher: 5h4m4n53c
Quiz And Survey Master <= 7.3.10 - Missing Authorization
4.3
CVE-2022-41652
Oct 21, 2022
Researcher: Thura Moe Myint (mgthuramoemyint)
WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API
4.3
CVE ID Unknown
Oct 18, 2022
Researcher: Than Taintor
Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure
4.3
CVE-2022-40696
Oct 18, 2022
Researcher: Juan Hoffmann
WP-Polls <= 2.76.0 - Race Condition
4.3
CVE-2022-40130
Oct 5, 2022
Researcher: Nguy Minh Tuan
WooCommerce Products Vendor <= 2.1.68 - Insecure Direct Object Reference to Vendor Commission Percentage Update
4.3
CVE ID Unknown
Oct 4, 2022
Researcher: foobar7
WooCommerce Products Vendor <= 2.1.65 - Insecure Direct Object Reference to Note Creation
4.3
CVE ID Unknown
Oct 4, 2022
Researcher: foobar7
Beebee Mini <= 1.2.0 - Unauthorized File Upload via ACF
4.3
CVE-2022-2594
Oct 3, 2022
Researcher: James Golovich
Accordions – Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated Arbitrary Options Update
4.3
CVE-2022-38104
Sep 29, 2022
Researcher: RE-ALTER
Customer Reviews for WooCommerce <= 5.3.5 - Sensitive Data Exposure
4.3
CVE-2022-40194
Sep 22, 2022
Researcher: Muhammad Daffa
Breeze <= 2.0.8 - Cross-Site Request Forgery via import_json_settings
4.3
CVE ID Unknown
Sep 19, 2022
Researchers:
WP Statistics <= 13.2.5 - Information Disclosure
4.3
CVE ID Unknown
Sep 7, 2022
Researchers:
WP Shamsi <= 4.1.1 - Missing Authorization to Plugin Settings Update
4.3
CVE-2022-38058
Sep 5, 2022
Researcher: Muhammad Daffa
Rate my Post – WP Rating System <= 3.3.4 - Race Condition
4.3
CVE-2022-40310
Sep 1, 2022
Researcher: Nguy Minh Tuan
WP-PostRatings <= 1.89 - Race Condition
4.3
CVE-2022-36422
Aug 31, 2022
Researcher: Nguy Minh Tuan
WordPress Ping Optimizer <= 2.35.1.2.3 - Cross-Site Request Forgery
4.3
CVE-2022-1591
Aug 23, 2022
Researcher: Daniel Ruf
Title CVE ID CVSS Researchers Date
TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference CVE-2022-3995 4.3 Marco Wotschka October 31, 2022
Appointment Booking Calendar <= 1.3.69 - Missing Authorization CVE-2022-43482 4.3 István Márton October 30, 2022
Appointment Hour Booking <= 1.3.71 - Missing Authorization CVE-2022-41692 4.3 István Márton October 30, 2022
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes CVE-2022-3361 4.3 Ruijie Li October 28, 2022
Syncee – Global Dropshipping <= 1.0.9 - Missing Authorization. CVE-2022-3694 4.3 5h4m4n53c October 27, 2022
Quiz And Survey Master <= 7.3.10 - Missing Authorization CVE-2022-41652 4.3 Thura Moe Myint (mgthuramoemyint) October 21, 2022
WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API 4.3 Than Taintor October 18, 2022
Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure CVE-2022-40696 4.3 Juan Hoffmann October 18, 2022
WP-Polls <= 2.76.0 - Race Condition CVE-2022-40130 4.3 Nguy Minh Tuan October 5, 2022
WooCommerce Products Vendor <= 2.1.68 - Insecure Direct Object Reference to Vendor Commission Percentage Update 4.3 foobar7 October 4, 2022
WooCommerce Products Vendor <= 2.1.65 - Insecure Direct Object Reference to Note Creation 4.3 foobar7 October 4, 2022
Beebee Mini <= 1.2.0 - Unauthorized File Upload via ACF CVE-2022-2594 4.3 James Golovich October 3, 2022
Accordions – Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated Arbitrary Options Update CVE-2022-38104 4.3 RE-ALTER September 29, 2022
Customer Reviews for WooCommerce <= 5.3.5 - Sensitive Data Exposure CVE-2022-40194 4.3 Muhammad Daffa September 22, 2022
Breeze <= 2.0.8 - Cross-Site Request Forgery via import_json_settings 4.3 September 19, 2022
WP Statistics <= 13.2.5 - Information Disclosure 4.3 September 7, 2022
WP Shamsi <= 4.1.1 - Missing Authorization to Plugin Settings Update CVE-2022-38058 4.3 Muhammad Daffa September 5, 2022
Rate my Post – WP Rating System <= 3.3.4 - Race Condition CVE-2022-40310 4.3 Nguy Minh Tuan September 1, 2022
WP-PostRatings <= 1.89 - Race Condition CVE-2022-36422 4.3 Nguy Minh Tuan August 31, 2022
WordPress Ping Optimizer <= 2.35.1.2.3 - Cross-Site Request Forgery CVE-2022-1591 4.3 Daniel Ruf August 23, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 21, 2024
Vulns
1 stealthcopter 24
2 Francesco Carlucci 20
3 wesley (wcraft) 19
4 Lucio Sá 19
5 Daniel Ruf 16
6 vgo0 15
7 Rafie Muhammad 12
8 Dave Jong 11
9 Ananda Dhakal 9
10 Marco Wotschka 8
11 Muhammad Daffa 6
12 Krzysztof Zając 6
13 Webbernaut 5
14 Fariq Fadillah Gusti Insani (fariqfgi) 5
15 Le Ngoc Anh 5
16 Bob Matyas 5
17 João Pedro Soares de Alcântara 5
18 István Márton 4
19 LVT-tholv2k 4
20 Peter Thaleikis 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation