🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload

8.8

CVE-2023-6979

Jan 9, 2024

Researcher: Artem Guzhva (hexcat)

Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection

8.8

CVE-2023-52219

Jan 5, 2024

Researcher: Rafie Muhammad

Randomize <= 1.4.3 - Authenticated (Contributor+) SQL Injection

8.8

CVE-2023-52204

Jan 3, 2024

Researcher: Ngô Thiên An (ancorn_)

HTML5 MP3 Player with Folder Feedburner <= 2.8.0 - Authenticated (Author+) PHP Object Injection

8.8

CVE-2023-52202

Jan 3, 2024

Researcher: Rafie Muhammad

Page Builder: Live Composer <= 1.5.25 - Authenticated (Author+) PHP Object Injection

8.8

CVE-2023-52206

Jan 3, 2024

Researcher: Le Ngoc Anh

HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton

8.8

CVE-2023-52207

Jan 3, 2024

Researcher: Rafie Muhammad

HTML5 SoundCloud Player <= 2.8.0 - Authenticated (Author+) PHP Object Injection

8.8

CVE-2023-52205

Jan 3, 2024

Researcher: Rafie Muhammad

Recipe Maker For Your Food Blog from Zip Recipes <= 8.1.0 - Authenticated(Contributor+) SQL Injection

8.8

CVE-2023-52180

Dec 29, 2023

Researcher: Muhammad Daffa

ARI Stream Quiz <= 1.3.0 - Authenticated (Contributor+) PHP Object Injection

8.8

CVE-2023-52182

Dec 29, 2023

Researcher: Rafie Muhammad

Most And Least Read Posts Widget <=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings

8.8

CVE-2023-52133

Dec 28, 2023

Researcher: Muhammad Daffa

Events Shortcodes & Templates For The Events Calendar <= 2.3.1 - Authenticated (Contributor+) SQL Injection via shortcode

8.8

CVE-2023-52142

Dec 28, 2023

Researcher: Muhammad Daffa

JVM rich text icons <= 1.2.3 - Authenticated(Subscriber+) Arbitrary File Upload

8.8

CVE-2023-51417

Dec 27, 2023

Researcher: Rafie Muhammad

TerraClassifieds <= 2.0.3 - Cross-Site Request Forgery

8.8

CVE-2023-51474

Dec 27, 2023

Researcher: Rafie Muhammad

JVM rich text icons <= 1.2.6 - Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion

8.8

CVE-2023-51418

Dec 27, 2023

Researcher: Rafie Muhammad

Build App Online <= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update

8.8

CVE-2023-51479

Dec 27, 2023

Researcher: Rafie Muhammad

Verge3D <= 4.5.2 - Authenticated(Subscriber+) Arbitrary File Upload

8.8

CVE-2023-51421

Dec 27, 2023

Researcher: Rafie Muhammad

Rencontre – Dating Site <= 3.11.1 - Authenticated (Subscriber+) PHP Object Injection

8.8

CVE-2023-51470

Dec 27, 2023

Researcher: Rafie Muhammad

Job Manager & Career – Manage job board listings, and recruitments <= 1.4.4 - Cross-Site Request Forgery to PHP Object Injection

8.8

CVE-2023-51545

Dec 27, 2023

Researcher: Rafie Muhammad

WP Mail Log Plugin <= 1.1.2 - Authenticated(Contributor+) Arbitrary File Upload

8.8

CVE-2023-51410

Dec 27, 2023

Researcher: Rafie Muhammad

Ultimate Addons for Beaver Builder <= 1.35.14 - Authenticated(Contributor+) Privilege Escalation

8.8

CVE-2023-51398

Dec 26, 2023

Researcher: Rafie Muhammad

Title	CVE ID	CVSS	Researchers	Date
Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload	CVE-2023-6979	8.8	Artem Guzhva (hexcat)	January 9, 2024
Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection	CVE-2023-52219	8.8	Rafie Muhammad	January 5, 2024
Randomize <= 1.4.3 - Authenticated (Contributor+) SQL Injection	CVE-2023-52204	8.8	Ngô Thiên An (ancorn_)	January 3, 2024
HTML5 MP3 Player with Folder Feedburner <= 2.8.0 - Authenticated (Author+) PHP Object Injection	CVE-2023-52202	8.8	Rafie Muhammad	January 3, 2024
Page Builder: Live Composer <= 1.5.25 - Authenticated (Author+) PHP Object Injection	CVE-2023-52206	8.8	Le Ngoc Anh	January 3, 2024
HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton	CVE-2023-52207	8.8	Rafie Muhammad	January 3, 2024
HTML5 SoundCloud Player <= 2.8.0 - Authenticated (Author+) PHP Object Injection	CVE-2023-52205	8.8	Rafie Muhammad	January 3, 2024
Recipe Maker For Your Food Blog from Zip Recipes <= 8.1.0 - Authenticated(Contributor+) SQL Injection	CVE-2023-52180	8.8	Muhammad Daffa	December 29, 2023
ARI Stream Quiz <= 1.3.0 - Authenticated (Contributor+) PHP Object Injection	CVE-2023-52182	8.8	Rafie Muhammad	December 29, 2023
Most And Least Read Posts Widget <=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings	CVE-2023-52133	8.8	Muhammad Daffa	December 28, 2023
Events Shortcodes & Templates For The Events Calendar <= 2.3.1 - Authenticated (Contributor+) SQL Injection via shortcode	CVE-2023-52142	8.8	Muhammad Daffa	December 28, 2023
JVM rich text icons <= 1.2.3 - Authenticated(Subscriber+) Arbitrary File Upload	CVE-2023-51417	8.8	Rafie Muhammad	December 27, 2023
TerraClassifieds <= 2.0.3 - Cross-Site Request Forgery	CVE-2023-51474	8.8	Rafie Muhammad	December 27, 2023
JVM rich text icons <= 1.2.6 - Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion	CVE-2023-51418	8.8	Rafie Muhammad	December 27, 2023
Build App Online <= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update	CVE-2023-51479	8.8	Rafie Muhammad	December 27, 2023
Verge3D <= 4.5.2 - Authenticated(Subscriber+) Arbitrary File Upload	CVE-2023-51421	8.8	Rafie Muhammad	December 27, 2023
Rencontre – Dating Site <= 3.11.1 - Authenticated (Subscriber+) PHP Object Injection	CVE-2023-51470	8.8	Rafie Muhammad	December 27, 2023
Job Manager & Career – Manage job board listings, and recruitments <= 1.4.4 - Cross-Site Request Forgery to PHP Object Injection	CVE-2023-51545	8.8	Rafie Muhammad	December 27, 2023
WP Mail Log Plugin <= 1.1.2 - Authenticated(Contributor+) Arbitrary File Upload	CVE-2023-51410	8.8	Rafie Muhammad	December 27, 2023
Ultimate Addons for Beaver Builder <= 1.35.14 - Authenticated(Contributor+) Privilege Escalation	CVE-2023-51398	8.8	Rafie Muhammad	December 26, 2023

Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Aug 29, 2024 Vulns
1	Francesco Carlucci	33
2	vgo0	27
3	wesley (wcraft)	21
4	Lucio Sá	13
5	Krzysztof Zając	10
6	stealthcopter	10
7	Marco Wotschka	7
8	Peter Thaleikis	7
9	Webbernaut	6
10	TANG Cheuk Hei (siunam)	5
11	Daniel Ruf	5
12	rezaduty	5
13	zer0gh0st	4
14	LVT-tholv2k	3
15	Robert DeVore	3
16	Le Ngoc Anh	3
17	RyotaK	2
18	Jorge Diaz (ddiax)	2
19	Tonn	2
20	Ankit Patel	2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation