🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute

6.4

CVE-2024-5425

Jun 6, 2024

Researcher: Webbernaut

Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-4488

Jun 6, 2024

Researcher: Ngô Thiên An (ancorn_)

Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.3 - Reflected Cross-Site Scripting

6.1

CVE-2024-35730

Jun 6, 2024

Researcher: Le Ngoc Anh

GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting

5.4

CVE-2024-5607

Jun 6, 2024

Researcher: Lucio Sá

Block for Font Awesome <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-35705

Jun 6, 2024

Researcher: Ngô Thiên An (ancorn_)

Visualizer <= 3.11.1 - Authenticated (Subscriber+) SQL Injection

9.9

CVE-2024-35736

Jun 6, 2024

Researcher: Trương Hữu Phúc (truonghuuphuc)

Leyka <= 3.31.1 - Missing Authorization

5.3

CVE-2024-35683

Jun 6, 2024

Researcher: Mika

Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification

4.3

CVE-2023-6491

Jun 6, 2024

Researcher: Rafshanzani Suhada

Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion

7.5

CVE-2024-5637

Jun 6, 2024

Researcher: Lucio Sá

RestroPress – Online Food Ordering System <= 3.1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-35719

Jun 6, 2024

Researcher: LVT-tholv2k

Kognetiks Chatbot for WordPress <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-35738

Jun 6, 2024

Researcher: LVT-tholv2k

WP Time Slots Booking Form <= 1.2.11 - Missing Authorization

5.3

CVE-2024-35735

Jun 6, 2024

Researcher: Manab Jyoti Dowarah

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-35739

Jun 6, 2024

Researcher: SouzaZinn

H5P <= 1.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-3111

Jun 6, 2024

Researcher: Dmitrii Ignatyev

Bloglo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-35715

Jun 6, 2024

Researcher: stealthcopter

Bosa Elementor Addons and Templates for WooCommerce <= 1.0.12 - Missing Authorization

5.4

CVE-2024-35724

Jun 6, 2024

Researcher: Abdi Pranata

12 Step Meeting List <= 3.14.33 - Reflected Cross-Site Scripting

6.1

CVE-2024-35693

Jun 6, 2024

Researcher: alien8

Link Library <= 7.6.3 - Reflected Cross-Site Scripting

6.1

CVE-2024-35687

Jun 6, 2024

Researcher: Dimas Maulana

Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.11 - Authenticated (Subscriber+) Information Exposure

5.3

CVE-2024-35682

Jun 6, 2024

Researcher: Dave Jong

YITH WooCommerce Product Add-Ons <= 4.9.2 - Unauthenticated Content Injection

5.3

CVE-2024-35680

Jun 6, 2024

Researcher: Phill Sav (Savphill)

Title	CVE ID	CVSS	Researchers	Date
WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute	CVE-2024-5425	6.4	Webbernaut	June 6, 2024
Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-4488	6.4	Ngô Thiên An (ancorn_)	June 6, 2024
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.3 - Reflected Cross-Site Scripting	CVE-2024-35730	6.1	Le Ngoc Anh	June 6, 2024
GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting	CVE-2024-5607	5.4	Lucio Sá	June 6, 2024
Block for Font Awesome <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35705	6.4	Ngô Thiên An (ancorn_)	June 6, 2024
Visualizer <= 3.11.1 - Authenticated (Subscriber+) SQL Injection	CVE-2024-35736	9.9	Trương Hữu Phúc (truonghuuphuc)	June 6, 2024
Leyka <= 3.31.1 - Missing Authorization	CVE-2024-35683	5.3	Mika	June 6, 2024
Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification	CVE-2023-6491	4.3	Rafshanzani Suhada	June 6, 2024
Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion	CVE-2024-5637	7.5	Lucio Sá	June 6, 2024
RestroPress – Online Food Ordering System <= 3.1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35719	6.4	LVT-tholv2k	June 6, 2024
Kognetiks Chatbot for WordPress <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35738	6.4	LVT-tholv2k	June 6, 2024
WP Time Slots Booking Form <= 1.2.11 - Missing Authorization	CVE-2024-35735	5.3	Manab Jyoti Dowarah	June 6, 2024
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35739	6.4	SouzaZinn	June 6, 2024
H5P <= 1.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-3111	6.4	Dmitrii Ignatyev	June 6, 2024
Bloglo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-35715	6.4	stealthcopter	June 6, 2024
Bosa Elementor Addons and Templates for WooCommerce <= 1.0.12 - Missing Authorization	CVE-2024-35724	5.4	Abdi Pranata	June 6, 2024
12 Step Meeting List <= 3.14.33 - Reflected Cross-Site Scripting	CVE-2024-35693	6.1	alien8	June 6, 2024
Link Library <= 7.6.3 - Reflected Cross-Site Scripting	CVE-2024-35687	6.1	Dimas Maulana	June 6, 2024
Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.11 - Authenticated (Subscriber+) Information Exposure	CVE-2024-35682	5.3	Dave Jong	June 6, 2024
YITH WooCommerce Product Add-Ons <= 4.9.2 - Unauthenticated Content Injection	CVE-2024-35680	5.3	Phill Sav (Savphill)	June 6, 2024

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 29, 2024 Vulns
1	Francesco Carlucci	33
2	vgo0	27
3	wesley (wcraft)	21
4	Lucio Sá	13
5	Krzysztof Zając	10
6	stealthcopter	10
7	Marco Wotschka	7
8	Peter Thaleikis	7
9	Webbernaut	6
10	TANG Cheuk Hei (siunam)	5
11	Daniel Ruf	5
12	rezaduty	5
13	zer0gh0st	4
14	LVT-tholv2k	3
15	Robert DeVore	3
16	Le Ngoc Anh	3
17	RyotaK	2
18	Jorge Diaz (ddiax)	2
19	Tonn	2
20	Ankit Patel	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation