WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion
4.3
CVE-2024-8476
Sep 24, 2024
Researcher: Krzysztof Zając
WP Free SSL – Free SSL Certificate for WordPress and force HTTPS <= 1.2.6 - Missing Authorization
4.3
CVE-2024-44020
Sep 24, 2024
Researcher: Abdi Pranata
Crowdsignal Dashboard – Polls, Surveys & more <= 3.1.2 - Cross-Site Request Forgery
4.3
CVE-2024-43338
Sep 24, 2024
Researcher: Rafie Muhammad
Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update
4.3
CVE-2024-8432
Sep 23, 2024
Researcher: Lucio Sá
Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2024-8801
Sep 23, 2024
Researcher: Ankit Patel
WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation
4.3
CVE-2024-8437
Sep 23, 2024
Researcher: Lucio Sá
Simple Nav Archives <= 2.1.3 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2024-8398
Sep 20, 2024
Researcher: Daniel Ruf
WooCommerce Multilingual & Multicurrency <= 5.3.6 - Missing Authorization
4.3
CVE-2024-44006
Sep 16, 2024
Researcher: Rafie Muhammad
GDPR Cookie Consent <= 2.6.0 - Cross-Site Request Forgery to Bulk Delete
4.3
CVE-2024-8286
Sep 16, 2024
Researcher: Bob Matyas
Custom Author Base <= 1.1.1 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2024-8050
Sep 13, 2024
Researcher: Daniel Ruf
Ntz Antispam <= 2.0e - Cross-Site Request Forgery to Settings Update
4.3
CVE-2024-8094
Sep 13, 2024
Researcher: Daniel Ruf
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload
4.3
CVE-2024-8242
Sep 12, 2024
Researcher: stealthcopter
HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
4.3
CVE-2024-7721
Sep 10, 2024
Researcher: Lucio Sá
Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'
4.3
CVE-2023-2919
Sep 9, 2024
Researcher: Ram
Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
4.3
CVE-2024-7622
Sep 6, 2024
Researcher: Lucio Sá
Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure
4.3
CVE-2024-8538
Sep 6, 2024
Researcher: 2tokui
Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
4.3
CVE-2024-8427
Sep 5, 2024
Researcher: Lucio Sá
Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion
4.3
CVE-2024-7380
Sep 4, 2024
Researcher: Lucio Sá
adstxt Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2024-7892
Sep 4, 2024
Researcher: Norbert Hofmann
HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update
4.3
CVE-2024-7605
Sep 4, 2024
Researcher: Peter Thaleikis
Title CVE ID CVSS Researchers Date
Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion CVE-2024-8476 4.3 Krzysztof Zając September 24, 2024
WP Free SSL – Free SSL Certificate for WordPress and force HTTPS <= 1.2.6 - Missing Authorization CVE-2024-44020 4.3 Abdi Pranata September 24, 2024
Crowdsignal Dashboard – Polls, Surveys & more <= 3.1.2 - Cross-Site Request Forgery CVE-2024-43338 4.3 Rafie Muhammad September 24, 2024
Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update CVE-2024-8432 4.3 Lucio Sá September 23, 2024
Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2024-8801 4.3 Ankit Patel September 23, 2024
WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation CVE-2024-8437 4.3 Lucio Sá September 23, 2024
Simple Nav Archives <= 2.1.3 - Cross-Site Request Forgery to Settings Update CVE-2024-8398 4.3 Daniel Ruf September 20, 2024
WooCommerce Multilingual & Multicurrency <= 5.3.6 - Missing Authorization CVE-2024-44006 4.3 Rafie Muhammad September 16, 2024
GDPR Cookie Consent <= 2.6.0 - Cross-Site Request Forgery to Bulk Delete CVE-2024-8286 4.3 Bob Matyas September 16, 2024
Custom Author Base <= 1.1.1 - Cross-Site Request Forgery to Settings Update CVE-2024-8050 4.3 Daniel Ruf September 13, 2024
Ntz Antispam <= 2.0e - Cross-Site Request Forgery to Settings Update CVE-2024-8094 4.3 Daniel Ruf September 13, 2024
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload CVE-2024-8242 4.3 stealthcopter September 12, 2024
HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update CVE-2024-7721 4.3 Lucio Sá September 10, 2024
Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' CVE-2023-2919 4.3 Ram September 9, 2024
Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending CVE-2024-7622 4.3 Lucio Sá September 6, 2024
Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure CVE-2024-8538 4.3 2tokui September 6, 2024
Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update CVE-2024-8427 4.3 Lucio Sá September 5, 2024
Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion CVE-2024-7380 4.3 Lucio Sá September 4, 2024
adstxt Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update CVE-2024-7892 4.3 Norbert Hofmann September 4, 2024
HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update CVE-2024-7605 4.3 Peter Thaleikis September 4, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Nov 22, 2024
Vulns
1 SOPROBRO 119
2 vgo0 62
3 Peter Thaleikis 57
4 João Pedro Soares de Alcântara 37
5 Mika 36
6 Francesco Carlucci 36
7 stealthcopter 22
8 theviper17y 19
9 zaim 19
10 thiennv 15
11 ardias 15
12 Gab 15
13 zakaria 14
14 Arkadiusz Hydzik 14
15 Colin Xu 13
16 LVT-tholv2k 11
17 yudha 11
18 Tieu Pham Trong Nhan 11
19 zer0gh0st 11
20 Trương Hữu Phúc (truonghuuphuc) 11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation