WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
EventCalendar <= 1.1.21 - Cross-Site Scripting
5.4
CVE-2018-16164
Nov 2, 2018
Researcher: Yuta Kitaoka
WP Editor.md – The Perfect WordPress Markdown Editor < 10.0.4 - Cross-Site Scripting
4.8
CVE-2018-18919
Oct 31, 2018
Researcher: H4ckForJob
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership <= 1.4.13 - Arbitrary File Upload
9.8
CVE-2019-1010209
Oct 31, 2018
Researcher: Pouya Darabi
Elegant Themes (Various Versions) - Stored Cross-Site Scripting
6.4
CVE ID Unknown
Oct 30, 2018
Researchers:
Calendar <= 1.3.10 - Authenticated Stored Cross-Site Scripting
5.4
CVE-2018-18872
Oct 30, 2018
Researcher: boombyte
Rockhoist Ratings < 1.2.3 - SQL Injection
9.8
CVE ID Unknown
Oct 28, 2018
Researchers:
Elementor Pro <= 2.0.9 - Cross-Site Scripting
6.1
CVE-2018-18379
Oct 26, 2018
Researcher: Christopher Vella
Pie Register < 3.0.18 - Unauthenticated Cross-Site Scripting
7.1
CVE ID Unknown
Oct 24, 2018
Researcher: Alvaro J. Gene
WP-DBManager <= 2.79.1 - Directory Traversal Allowing Arbitrary File Deletion
8.7
CVE ID Unknown
Oct 22, 2018
Researcher: RIPS Technologies
AMP for WP <= 0.9.97.19 - Missing Authorization
6.3
CVE ID Unknown
Oct 20, 2018
Researcher: Sybre Waaijer
All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting
6.4
CVE ID Unknown
Oct 18, 2018
Researcher: RIPS Technologies
WP Live Chat Support <= 8.0.15 - Cross-Site Scripting
6.1
CVE-2018-18460
Oct 17, 2018
Researcher: rakjong
Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload
9.8
CVE-2018-18461
Oct 17, 2018
Researcher: rakjong
Repute ARForms <= 3.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal
7.5
CVE-2018-15818
Oct 17, 2018
Researcher: Amir Hossein Mahboubi
Support Board for WordPress <= 1.2.3 - Cross-Site Scripting
6.4
CVE-2018-18373
Oct 16, 2018
Researcher: Ismail Tasdelen
Tajer <= 1.0.5 - Arbitrary File Upload
9.8
CVE-2018-9206
Oct 15, 2018
Researcher: Larry W. Cashdollar
Image Intense <= 3.2.5 - SQL Injection
8.8
CVE ID Unknown
Oct 11, 2018
Researchers:
WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action
6.1
CVE-2018-17583
Oct 9, 2018
Researcher: Mohammed Ansari
WP Fastest Cache <= 0.8.8.5 - Cross-Site Request Forgery via page to wpfastestcacheoptions
8.8
CVE-2018-17584
Oct 9, 2018
Researcher: Mohammed Ansari
WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via rules[0][content] parameter
6.1
CVE-2018-17586
Oct 9, 2018
Researcher: Mohammed Ansari
Title CVE ID CVSS Researchers Date
EventCalendar <= 1.1.21 - Cross-Site Scripting CVE-2018-16164 5.4 Yuta Kitaoka November 2, 2018
WP Editor.md – The Perfect WordPress Markdown Editor < 10.0.4 - Cross-Site Scripting CVE-2018-18919 4.8 H4ckForJob October 31, 2018
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership <= 1.4.13 - Arbitrary File Upload CVE-2019-1010209 9.8 Pouya Darabi October 31, 2018
Elegant Themes (Various Versions) - Stored Cross-Site Scripting 6.4 October 30, 2018
Calendar <= 1.3.10 - Authenticated Stored Cross-Site Scripting CVE-2018-18872 5.4 boombyte October 30, 2018
Rockhoist Ratings < 1.2.3 - SQL Injection 9.8 October 28, 2018
Elementor Pro <= 2.0.9 - Cross-Site Scripting CVE-2018-18379 6.1 Christopher Vella October 26, 2018
Pie Register < 3.0.18 - Unauthenticated Cross-Site Scripting 7.1 Alvaro J. Gene October 24, 2018
WP-DBManager <= 2.79.1 - Directory Traversal Allowing Arbitrary File Deletion 8.7 RIPS Technologies October 22, 2018
AMP for WP <= 0.9.97.19 - Missing Authorization 6.3 Sybre Waaijer October 20, 2018
All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting 6.4 RIPS Technologies October 18, 2018
WP Live Chat Support <= 8.0.15 - Cross-Site Scripting CVE-2018-18460 6.1 rakjong October 17, 2018
Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload CVE-2018-18461 9.8 rakjong October 17, 2018
Repute ARForms <= 3.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal CVE-2018-15818 7.5 Amir Hossein Mahboubi October 17, 2018
Support Board for WordPress <= 1.2.3 - Cross-Site Scripting CVE-2018-18373 6.4 Ismail Tasdelen October 16, 2018
Tajer <= 1.0.5 - Arbitrary File Upload CVE-2018-9206 9.8 Larry W. Cashdollar October 15, 2018
Image Intense <= 3.2.5 - SQL Injection 8.8 October 11, 2018
WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action CVE-2018-17583 6.1 Mohammed Ansari October 9, 2018
WP Fastest Cache <= 0.8.8.5 - Cross-Site Request Forgery via page to wpfastestcacheoptions CVE-2018-17584 8.8 Mohammed Ansari October 9, 2018
WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via rules[0][content] parameter CVE-2018-17586 6.1 Mohammed Ansari October 9, 2018
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Dec 11, 2024
Vulns
1 SOPROBRO 82
2 vgo0 59
3 Peter Thaleikis 38
4 João Pedro Soares de Alcântara 36
5 Mika 35
6 Rafie Muhammad 33
7 Lucio Sá 26
8 Francesco Carlucci 21
9 zaim 21
10 yudha 18
11 theviper17y 15
12 ardias 15
13 LVT-tholv2k 13
14 zakaria 12
15 Webbernaut 12
16 Tieu Pham Trong Nhan 11
17 thiennv 10
18 zer0gh0st 9
19 Arkadiusz Hydzik 9
20 Bonds 9

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation