🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

WPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting

6.1

CVE-2024-10890

Nov 20, 2024

Researcher: Peter Thaleikis

My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export

4.3

CVE-2024-11334

Nov 20, 2024

Researcher: SOPROBRO

Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context

7.2

CVE-2024-10788

Nov 20, 2024

Researcher: mikemyers

Beds24 Online Booking <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode

6.4

CVE-2024-10177

Nov 20, 2024

Researcher: Peter Thaleikis

WPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode

6.4

CVE-2024-10172

Nov 20, 2024

Researcher: Peter Thaleikis

Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import

4.3

CVE-2024-10532

Nov 20, 2024

Researcher: Lucio Sá

Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode

6.4

CVE-2024-10164

Nov 20, 2024

Researcher: Peter Thaleikis

Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter

6.1

CVE-2024-10522

Nov 20, 2024

Researcher: vgo0

Lock User Account <= 1.0.5 - User Lock Bypass

4.2

CVE-2024-11197

Nov 20, 2024

Researcher: Francesco Carlucci

Page Parts <= 1.4.3 - Reflected Cross-Site Scripting

6.1

CVE-2024-11360

Nov 20, 2024

Researcher: vgo0

Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting

6.1

CVE-2024-11365

Nov 20, 2024

Researcher: vgo0

Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting

6.1

CVE-2024-11370

Nov 20, 2024

Researcher: vgo0

Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion

4.3

CVE-2024-11354

Nov 20, 2024

Researcher: Mika

Include Mastodon Feed <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11455

Nov 20, 2024

Researcher: Peter Thaleikis

SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11432

Nov 20, 2024

Researcher: zakaria

salavat counter Plugin <= 0.9.1 - Reflected Cross-Site Scripting

6.1

CVE-2024-11435

Nov 20, 2024

Researcher: Colin Xu

LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4

CVE-2024-9851

Nov 20, 2024

Researcher: Francesco Carlucci

RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11414

Nov 20, 2024

Researcher: SOPROBRO

WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1

CVE-2024-11416

Nov 20, 2024

Researcher: SOPROBRO

Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11440

Nov 20, 2024

Researcher: zakaria

Title	CVE ID	CVSS	Researchers	Date
WPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting	CVE-2024-10890	6.1	Peter Thaleikis	November 20, 2024
My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export	CVE-2024-11334	4.3	SOPROBRO	November 20, 2024
Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context	CVE-2024-10788	7.2	mikemyers	November 20, 2024
Beds24 Online Booking <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode	CVE-2024-10177	6.4	Peter Thaleikis	November 20, 2024
WPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode	CVE-2024-10172	6.4	Peter Thaleikis	November 20, 2024
Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import	CVE-2024-10532	4.3	Lucio Sá	November 20, 2024
Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode	CVE-2024-10164	6.4	Peter Thaleikis	November 20, 2024
Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter	CVE-2024-10522	6.1	vgo0	November 20, 2024
Lock User Account <= 1.0.5 - User Lock Bypass	CVE-2024-11197	4.2	Francesco Carlucci	November 20, 2024
Page Parts <= 1.4.3 - Reflected Cross-Site Scripting	CVE-2024-11360	6.1	vgo0	November 20, 2024
Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting	CVE-2024-11365	6.1	vgo0	November 20, 2024
Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting	CVE-2024-11370	6.1	vgo0	November 20, 2024
Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion	CVE-2024-11354	4.3	Mika	November 20, 2024
Include Mastodon Feed <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11455	6.4	Peter Thaleikis	November 20, 2024
SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11432	6.4	zakaria	November 20, 2024
salavat counter Plugin <= 0.9.1 - Reflected Cross-Site Scripting	CVE-2024-11435	6.1	Colin Xu	November 20, 2024
LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	CVE-2024-9851	6.4	Francesco Carlucci	November 20, 2024
RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11414	6.4	SOPROBRO	November 20, 2024
WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting	CVE-2024-11416	6.1	SOPROBRO	November 20, 2024
Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11440	6.4	zakaria	November 20, 2024

Submit Vulnerability

1
2
3
4
5
6
...
1019
1020
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Oct 22, 2024 Vulns
1	SOPROBRO	214
2	Francesco Carlucci	66
3	João Pedro Soares de Alcântara	51
4	Peter Thaleikis	47
5	stealthcopter	45
6	Gab	42
7	vgo0	34
8	István Márton	28
9	LVT-tholv2k	23
10	zer0gh0st	14
11	wesley (wcraft)	14
12	Trương Hữu Phúc (truonghuuphuc)	13
13	Tonn	12
14	Mika	12
15	Arkadiusz Hydzik	12
16	theviper17y	12
17	Tieu Pham Trong Nhan	9
18	Ankit Patel	8
19	Webbernaut	8
20	Colin Xu	8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation