WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
4.3
CVE-2024-9364
Oct 17, 2024
Researcher: Nishiv
Photo Gallery Builder <= 3.0 - Missing Authorization
4.3
CVE-2024-49325
Oct 17, 2024
Researcher: Marek Mikita
Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure
4.3
CVE-2024-7417
Oct 16, 2024
Researcher: stealthcopter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation
4.3
CVE-2024-9352
Oct 16, 2024
Researcher: Vijaysimha Reddy (vijaysimha)
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation
4.3
CVE-2024-9351
Oct 16, 2024
Researcher: Vijaysimha Reddy (vijaysimha)
WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion
4.3
CVE-2024-9649
Oct 15, 2024
Researcher: Bilal Chawich (Duke)
Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
4.3
CVE-2024-9891
Oct 15, 2024
Researcher: Tieu Pham Trong Nhan
Cooked Pro < 1.8.0 - Cross-Site Request Forgery
4.3
CVE-2024-49290
Oct 15, 2024
Researcher: RE-ALTER
WP VR <= 8.5.4 - Missing Authorization
4.3
CVE-2024-49293
Oct 15, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template
4.3
CVE-2024-9540
Oct 15, 2024
Researcher: Nishiv
WP Content Copy Protection & No Right Click <= 3.5.9 - Cross-Site Request Forgery
4.3
CVE-2024-49306
Oct 15, 2024
Researcher: Rafie Muhammad
Simple Custom Post Order <= 2.5.7 - Missing Authorization
4.3
CVE-2024-49321
Oct 15, 2024
Researcher: Rafie Muhammad
Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
4.3
CVE-2024-6757
Oct 14, 2024
Researcher: stealthcopter
ProfileGrid <= 5.9.3 - Cross-Site Request Forgery
4.3
CVE-2024-49273
Oct 14, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
VOD Infomaniak <= 1.5.7 - Cross-Site Request Forgery
4.3
CVE-2024-49274
Oct 14, 2024
Researcher: Joshua Chan
Leyka <= 3.31.6 - Missing Authorization
4.3
CVE-2024-49252
Oct 14, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
Htaccess File Editor <= 1.0.18 - Missing Authorization
4.3
CVE-2024-49256
Oct 14, 2024
Researcher: SavPhill (Savphill)
Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
4.3
CVE-2024-9926
Oct 14, 2024
Researchers:
Linked Variation for WooCommerce <= 1.0.5 - Cross-Site Request Forgery
4.3
CVE-2024-48047
Oct 14, 2024
Researcher: Marek Mikita
IdeaPush <= 8.69 - Cross-Site Request Forgery
4.3
CVE-2024-49275
Oct 14, 2024
Researcher: theviper17y
Title CVE ID CVSS Researchers Date
SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion CVE-2024-9364 4.3 Nishiv October 17, 2024
Photo Gallery Builder <= 3.0 - Missing Authorization CVE-2024-49325 4.3 Marek Mikita October 17, 2024
Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure CVE-2024-7417 4.3 stealthcopter October 16, 2024
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation CVE-2024-9352 4.3 Vijaysimha Reddy (vijaysimha) October 16, 2024
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation CVE-2024-9351 4.3 Vijaysimha Reddy (vijaysimha) October 16, 2024
WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion CVE-2024-9649 4.3 Bilal Chawich (Duke) October 15, 2024
Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation CVE-2024-9891 4.3 Tieu Pham Trong Nhan October 15, 2024
Cooked Pro < 1.8.0 - Cross-Site Request Forgery CVE-2024-49290 4.3 RE-ALTER October 15, 2024
WP VR <= 8.5.4 - Missing Authorization CVE-2024-49293 4.3 Trương Hữu Phúc (truonghuuphuc) October 15, 2024
Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template CVE-2024-9540 4.3 Nishiv October 15, 2024
WP Content Copy Protection & No Right Click <= 3.5.9 - Cross-Site Request Forgery CVE-2024-49306 4.3 Rafie Muhammad October 15, 2024
Simple Custom Post Order <= 2.5.7 - Missing Authorization CVE-2024-49321 4.3 Rafie Muhammad October 15, 2024
Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function CVE-2024-6757 4.3 stealthcopter October 14, 2024
ProfileGrid <= 5.9.3 - Cross-Site Request Forgery CVE-2024-49273 4.3 Trương Hữu Phúc (truonghuuphuc) October 14, 2024
VOD Infomaniak <= 1.5.7 - Cross-Site Request Forgery CVE-2024-49274 4.3 Joshua Chan October 14, 2024
Leyka <= 3.31.6 - Missing Authorization CVE-2024-49252 4.3 Trương Hữu Phúc (truonghuuphuc) October 14, 2024
Htaccess File Editor <= 1.0.18 - Missing Authorization CVE-2024-49256 4.3 SavPhill (Savphill) October 14, 2024
Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2024-9926 4.3 October 14, 2024
Linked Variation for WooCommerce <= 1.0.5 - Cross-Site Request Forgery CVE-2024-48047 4.3 Marek Mikita October 14, 2024
IdeaPush <= 8.69 - Cross-Site Request Forgery CVE-2024-49275 4.3 theviper17y October 14, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Nov 23, 2024
Vulns
1 SOPROBRO 109
2 vgo0 62
3 Peter Thaleikis 57
4 João Pedro Soares de Alcântara 37
5 Mika 36
6 Francesco Carlucci 36
7 stealthcopter 22
8 theviper17y 19
9 zaim 19
10 thiennv 15
11 ardias 15
12 Gab 15
13 Arkadiusz Hydzik 14
14 zakaria 14
15 Colin Xu 13
16 Trương Hữu Phúc (truonghuuphuc) 11
17 LVT-tholv2k 11
18 zer0gh0st 11
19 yudha 11
20 Tieu Pham Trong Nhan 11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation