WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Chaty <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE ID Unknown
May 16, 2023
Researchers:
PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-2584
May 16, 2023
Researcher: Marco Wotschka
Stop Spammers Security <= 2022.6 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-2489
May 15, 2023
Researcher: Erwan LR
Sunny Search <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-32595
May 12, 2023
Researcher: Lokesh Dachepalli
Quick Page/Post Redirect <= 5.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-25063
May 12, 2023
Researcher: Justiice
WP Register Profile With Shortcode <= 3.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-23818
May 12, 2023
Researcher: Rio Darmawan
Button <= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-23871
May 12, 2023
Researcher: yuyudhn
iframe popup <= 3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-24394
May 12, 2023
Researcher: yuyudhn
itemprop WP for SERP/SEO Rich snippets <= 3.5.201706131 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-23819
May 12, 2023
Researcher: Rio Darmawan
weebotLite <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-32596
May 12, 2023
Researcher: Lokesh Dachepalli
Product page shipping calculator for WooCommerce <= 1.3.25 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
4.4
CVE-2023-32575
May 12, 2023
Researcher: Emili Castells
Get Your Number <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-2634
May 12, 2023
Researchers: Ilyase Dehy, Aymane Mazguiti
DBargain <= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-32591
May 12, 2023
Researcher: Mahesh Nagabhairava
Column-Matic <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
4.4
CVE-2023-32578
May 12, 2023
Researcher: Mika
Don8 <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-32582
May 11, 2023
Researcher: Yash Kanchhal
DevBuddy Twitter Feed <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-32577
May 11, 2023
Researcher: Rio Darmawan
LetterPress <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-27415
May 11, 2023
Researcher: Pavak Tiwari
NotifyVisitors <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-27426
May 11, 2023
Researcher: Pavak Tiwari
eBecas <= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
4.4
CVE-2023-32584
May 11, 2023
Researcher: Pavak Tiwari
Custom Field Suite <= 2.6.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-32515
May 10, 2023
Researcher: Taihei Shimamine
Title CVE ID CVSS Researchers Date
Chaty <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting 4.4 May 16, 2023
PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-2584 4.4 Marco Wotschka May 16, 2023
Stop Spammers Security <= 2022.6 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-2489 4.4 Erwan LR May 15, 2023
Sunny Search <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-32595 4.4 Lokesh Dachepalli May 12, 2023
Quick Page/Post Redirect <= 5.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-25063 4.4 Justiice May 12, 2023
WP Register Profile With Shortcode <= 3.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-23818 4.4 Rio Darmawan May 12, 2023
Button <= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-23871 4.4 yuyudhn May 12, 2023
iframe popup <= 3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-24394 4.4 yuyudhn May 12, 2023
itemprop WP for SERP/SEO Rich snippets <= 3.5.201706131 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-23819 4.4 Rio Darmawan May 12, 2023
weebotLite <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-32596 4.4 Lokesh Dachepalli May 12, 2023
Product page shipping calculator for WooCommerce <= 1.3.25 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings CVE-2023-32575 4.4 Emili Castells May 12, 2023
Get Your Number <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-2634 4.4 Ilyase Dehy, Aymane Mazguiti May 12, 2023
DBargain <= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-32591 4.4 Mahesh Nagabhairava May 12, 2023
Column-Matic <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-32578 4.4 Mika May 12, 2023
Don8 <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-32582 4.4 Yash Kanchhal May 11, 2023
DevBuddy Twitter Feed <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-32577 4.4 Rio Darmawan May 11, 2023
LetterPress <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-27415 4.4 Pavak Tiwari May 11, 2023
NotifyVisitors <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-27426 4.4 Pavak Tiwari May 11, 2023
eBecas <= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings CVE-2023-32584 4.4 Pavak Tiwari May 11, 2023
Custom Field Suite <= 2.6.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-32515 4.4 Taihei Shimamine May 10, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Dec 7, 2024
Vulns
1 SOPROBRO 85
2 vgo0 63
3 Peter Thaleikis 44
4 Mika 29
5 Francesco Carlucci 25
6 zaim 22
7 João Pedro Soares de Alcântara 18
8 Lucio Sá 16
9 stealthcopter 16
10 yudha 16
11 theviper17y 14
12 zakaria 13
13 Colin Xu 13
14 thiennv 13
15 Tieu Pham Trong Nhan 13
16 ardias 11
17 Arkadiusz Hydzik 10
18 LVT-tholv2k 9
19 mikemyers 9
20 Trương Hữu Phúc (truonghuuphuc) 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation