WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-6011
Jul 1, 2024
Researcher: Guido Iván García
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
5.3
CVE-2024-6088
Jul 1, 2024
Researcher: shaman0x01
IdeaPush <= 8.65 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-37461
Jul 1, 2024
Researcher: piro
The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag
6.4
CVE-2024-1427
Jul 1, 2024
Researcher: wesley (wcraft)
Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation
4.3
CVE-2024-6012
Jul 1, 2024
Researcher: Lucio Sá
Woffice <= 5.4.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-37472
Jul 1, 2024
Researcher: Rafie Muhammad
Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
6.4
CVE-2024-5666
Jun 28, 2024
Researcher: Francesco Carlucci
Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode
6.4
CVE-2024-6363
Jun 28, 2024
Researcher: vgo0
Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget
6.4
CVE-2024-5790
Jun 28, 2024
Researcher: wesley (wcraft)
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'
9.8
CVE-2024-6265
Jun 28, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-37428
Jun 28, 2024
Researcher: João G. Barbosa (4rCanJ0x!)
Elegant Pink <= 1.3.0 - Cross-Site Request Forgery to Notice Dismissal
4.3
CVE-2024-37426
Jun 28, 2024
Researcher: Dhabaleshwar Das
Blossom Shop <= 1.1.7 - Cross-Site Request Forgery to Notice Dismissal
4.3
CVE-2024-37412
Jun 28, 2024
Researcher: Dhabaleshwar Das
Paid Memberships Pro <= 3.0.4 - Unauthenticated Insecure Direct Object Reference to Order Status Update
5.3
CVE-2024-37277
Jun 28, 2024
Researcher: Rafie Muhammad
WP Job Manager - Resume Manager <= 2.1.0 - Missing Authorization
4.3
CVE-2024-37443
Jun 28, 2024
Researcher: Rafie Muhammad
Patreon WordPress <= 1.9.0 - Protection Mechanism Bypass
5.3
CVE-2024-37430
Jun 28, 2024
Researcher: MCboyIR
WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection
8.8
CVE-2024-2386
Jun 28, 2024
Researcher: Krzysztof Zając
Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-37420
Jun 28, 2024
Researcher: Majed Refaea
Depicter Slider <= 3.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-37414
Jun 28, 2024
Researcher: Steven Julian
Preschool and Kindergarten <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal
4.3
CVE-2024-37413
Jun 28, 2024
Researcher: Dhabaleshwar Das
Title CVE ID CVSS Researchers Date
Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-6011 4.4 Guido Iván García July 1, 2024
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass CVE-2024-6088 5.3 shaman0x01 July 1, 2024
IdeaPush <= 8.65 - Unauthenticated Stored Cross-Site Scripting CVE-2024-37461 7.2 piro July 1, 2024
The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag CVE-2024-1427 6.4 wesley (wcraft) July 1, 2024
Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation CVE-2024-6012 4.3 Lucio Sá July 1, 2024
Woffice <= 5.4.8 - Reflected Cross-Site Scripting CVE-2024-37472 6.1 Rafie Muhammad July 1, 2024
Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter CVE-2024-5666 6.4 Francesco Carlucci June 28, 2024
Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode CVE-2024-6363 6.4 vgo0 June 28, 2024
Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget CVE-2024-5790 6.4 wesley (wcraft) June 28, 2024
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' CVE-2024-6265 9.8 Trương Hữu Phúc (truonghuuphuc) June 28, 2024
WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-37428 6.4 João G. Barbosa (4rCanJ0x!) June 28, 2024
Elegant Pink <= 1.3.0 - Cross-Site Request Forgery to Notice Dismissal CVE-2024-37426 4.3 Dhabaleshwar Das June 28, 2024
Blossom Shop <= 1.1.7 - Cross-Site Request Forgery to Notice Dismissal CVE-2024-37412 4.3 Dhabaleshwar Das June 28, 2024
Paid Memberships Pro <= 3.0.4 - Unauthenticated Insecure Direct Object Reference to Order Status Update CVE-2024-37277 5.3 Rafie Muhammad June 28, 2024
WP Job Manager - Resume Manager <= 2.1.0 - Missing Authorization CVE-2024-37443 4.3 Rafie Muhammad June 28, 2024
Patreon WordPress <= 1.9.0 - Protection Mechanism Bypass CVE-2024-37430 5.3 MCboyIR June 28, 2024
WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection CVE-2024-2386 8.8 Krzysztof Zając June 28, 2024
Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-37420 9.9 Majed Refaea June 28, 2024
Depicter Slider <= 3.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-37414 4.4 Steven Julian June 28, 2024
Preschool and Kindergarten <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal CVE-2024-37413 4.3 Dhabaleshwar Das June 28, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jun 27, 2024
Vulns
1 stealthcopter 44
2 Dhabaleshwar Das 39
3 Lucio Sá 27
4 João Pedro Soares de Alcântara 25
5 Rafie Muhammad 25
6 István Márton 23
7 wesley (wcraft) 20
8 LVT-tholv2k 19
9 Majed Refaea 19
10 Joshua Chan 18
11 Dave Jong 17
12 Francesco Carlucci 14
13 Webbernaut 12
14 Peng Zhou 10
15 Krzysztof Zając 10
16 shaman0x01 9
17 akas wisnu aji 8
18 Ananda Dhakal 8
19 Dimas Maulana 8
20 Ngô Thiên An (ancorn_) 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation