WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Image Gallery with Slideshow <= 1.5.2 - SQL Injection via selectMulGallery
9.8
CVE-2017-1002015
Apr 1, 2017
Researcher: Larry W. Cashdollar
Image Gallery with Slideshow Plugin <= 1.5.2 - Blind SQL Injection via imgid
9.8
CVE-2017-1002013
Apr 1, 2017
Researcher: Larry W. Cashdollar
LayerSlider <= 6.2.0 - Cross-Site Request Forgery
8.8
CVE ID Unknown
Mar 28, 2017
Researcher: WpHutte
LayerSlider <= 6.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
8.8
CVE ID Unknown
Mar 28, 2017
Researcher: 0x21
File Download <= 1.4 - Open Proxy
8.2
CVE-2015-1000002
Mar 27, 2017
Researcher: Larry W. Cashdollar
YOP Poll <= 5.8.0 - Reflected Cross-Site Scripting
6.1
CVE-2017-2127
Mar 23, 2017
Researchers: Sho Ueshima, Takashi Honda, Tsuyoshi Ogawa, Minaho Umehara
Invite Anyone < 1.3.16 - Email Injection
7.5
CVE-2017-18543
Mar 22, 2017
Researchers:
Invite Anyone <= 1.3.15 - Improper Input Validation
7.5
CVE-2017-18545
Mar 22, 2017
Researchers:
Invite Anyone < 1.3.16 - Cross-Site Request Forgery
8.8
CVE-2017-18544
Mar 22, 2017
Researchers:
Search Everything <= 8.1.6 - SQL Injection
9.8
CVE-2017-18571
Mar 20, 2017
Researchers:
Simple Ads Manager <= 2.9.8.125 - Unauthenticated PHP Objection Injection
8.3
CVE ID Unknown
Mar 17, 2017
Researcher: Yorick Koster,
Membership Simplified <= 1.58 Beta - SQL Injection
8.8
CVE-2017-1002010
Mar 17, 2017
Researcher: Larry W. Cashdollar
Membership Simplified <= 1.58 - SQL Injection
9.8
CVE-2017-1002009
Mar 17, 2017
Researcher: Larry W. Cashdollar
Invite Anyone <= 1.3.14 - Change of Email Invitation Content
5.3
CVE-2017-6955
Mar 17, 2017
Researcher: Unknown
BuddyPress Docs <= 1.9.2 - Authorization Bypass
4.3
CVE-2017-6954
Mar 17, 2017
Researchers: Ewoud Vlasselaer, Eric SchayesNabeel Ahmed, Nabeel Ahmed
Dtracker <= 1.5 - Missing Authorization
7.5
CVE-2017-1002006
Mar 13, 2017
Researcher: Larry W. Cashdollar
Membership Simplified <= 1.58 - Arbitrary File Download
9.8
CVE-2017-1002008
Mar 13, 2017
Researchers: Larry W. Cashdollar, The Martian
Profile Builder < 2.5.8 - Cross-Site Scripting
5.5
CVE ID Unknown
Mar 10, 2017
Researcher: f3ci
Mail Masta <= 1.0 - SQL Injection via subscriber_email parameter
7.2
CVE-2017-6578
Mar 9, 2017
Researcher: hamkovic
PICA Photo Gallery <= 1.0 - SQL Injection
9.8
CVE ID Unknown
Mar 9, 2017
Researcher: Ihsan Sencan
Title CVE ID CVSS Researchers Date
Image Gallery with Slideshow <= 1.5.2 - SQL Injection via selectMulGallery CVE-2017-1002015 9.8 Larry W. Cashdollar April 1, 2017
Image Gallery with Slideshow Plugin <= 1.5.2 - Blind SQL Injection via imgid CVE-2017-1002013 9.8 Larry W. Cashdollar April 1, 2017
LayerSlider <= 6.2.0 - Cross-Site Request Forgery 8.8 WpHutte March 28, 2017
LayerSlider <= 6.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting 8.8 0x21 March 28, 2017
File Download <= 1.4 - Open Proxy CVE-2015-1000002 8.2 Larry W. Cashdollar March 27, 2017
YOP Poll <= 5.8.0 - Reflected Cross-Site Scripting CVE-2017-2127 6.1 Sho Ueshima, Takashi Honda, Tsuyoshi Ogawa, Minaho Umehara March 23, 2017
Invite Anyone < 1.3.16 - Email Injection CVE-2017-18543 7.5 March 22, 2017
Invite Anyone <= 1.3.15 - Improper Input Validation CVE-2017-18545 7.5 March 22, 2017
Invite Anyone < 1.3.16 - Cross-Site Request Forgery CVE-2017-18544 8.8 March 22, 2017
Search Everything <= 8.1.6 - SQL Injection CVE-2017-18571 9.8 March 20, 2017
Simple Ads Manager <= 2.9.8.125 - Unauthenticated PHP Objection Injection 8.3 Yorick Koster, March 17, 2017
Membership Simplified <= 1.58 Beta - SQL Injection CVE-2017-1002010 8.8 Larry W. Cashdollar March 17, 2017
Membership Simplified <= 1.58 - SQL Injection CVE-2017-1002009 9.8 Larry W. Cashdollar March 17, 2017
Invite Anyone <= 1.3.14 - Change of Email Invitation Content CVE-2017-6955 5.3 Unknown March 17, 2017
BuddyPress Docs <= 1.9.2 - Authorization Bypass CVE-2017-6954 4.3 Ewoud Vlasselaer, Eric SchayesNabeel Ahmed, Nabeel Ahmed March 17, 2017
Dtracker <= 1.5 - Missing Authorization CVE-2017-1002006 7.5 Larry W. Cashdollar March 13, 2017
Membership Simplified <= 1.58 - Arbitrary File Download CVE-2017-1002008 9.8 Larry W. Cashdollar, The Martian March 13, 2017
Profile Builder < 2.5.8 - Cross-Site Scripting 5.5 f3ci March 10, 2017
Mail Masta <= 1.0 - SQL Injection via subscriber_email parameter CVE-2017-6578 7.2 hamkovic March 9, 2017
PICA Photo Gallery <= 1.0 - SQL Injection 9.8 Ihsan Sencan March 9, 2017
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Nov 29, 2024
Vulns
1 SOPROBRO 84
2 vgo0 58
3 Peter Thaleikis 54
4 Mika 36
5 Francesco Carlucci 31
6 João Pedro Soares de Alcântara 30
7 stealthcopter 21
8 zaim 20
9 theviper17y 15
10 Colin Xu 14
11 ardias 14
12 Arkadiusz Hydzik 14
13 thiennv 14
14 zakaria 13
15 yudha 13
16 Tieu Pham Trong Nhan 12
17 Lucio Sá 12
18 Gab 11
19 zer0gh0st 10
20 mikemyers 9

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation