💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

WordPress Vulnerability Database

Wordfence Intelligence > Vulnerability Database

WordPress Core

WordPress Plugins

WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title

Searches through the title of each vulnerability for matches.

date

Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.

cvss-rating

Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.

researcher

Returns vulnerabilities credited to researchers containing the given text.

software

Returns vulnerabilities discovered in software containing the given text.

software-slug

Returns vulnerabilities discovered in software exactly matching the given slug.

software-type

Use plugin, theme or core to limit the search to the specified type of software.

By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability

WP-Cirrus <= 0.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-36692

Jul 4, 2023

Researcher: LEE SE HYOUNG

Reservation.Studio widget <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-24397

Jul 4, 2023

Researcher: Nithissh S

Simple Site Verify <= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-36688

Jul 4, 2023

Researcher: yuyudhn

Mobile Call Now & Map Buttons <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-24401

Jul 4, 2023

Researcher: Abdi Pranata

All-in-one Floating Contact Form <= 2.1.1 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings

4.4

CVE-2023-3248

Jul 3, 2023

Researcher: Dipak Panchal (th3.d1p4k)

Auto Location for WP Job Manager via Google <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting

4.4

CVE-2023-3344

Jul 3, 2023

Researcher: Bob Matyas

Knowledge Center <= 2.7 - Authenticated (Admin+) Cross-Site Scripting

4.4

CVE ID Unknown

Jun 30, 2023

Researchers:

My Content Management <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-34377

Jun 30, 2023

Researcher: emad

SP Project & Document Manager <= 4.67 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

4.4

CVE-2023-36530

Jun 30, 2023

Researcher: emad

Short URL <= 1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting

4.4

CVE-2023-1602

Jun 28, 2023

Researcher: Etan Imanol Castro Aldrete

Side Cart Woocommerce (Ajax) <= 2.2 Authenticated(Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-28415

Jun 28, 2023

Researcher: Yuki Haruma

Catalyst Connect Zoho CRM Client Portal <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2022-44629

Jun 27, 2023

Researcher: Hoang Van Hiep

WP Abstracts <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-28692

Jun 27, 2023

Researcher: qilin_99

ARMember <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2022-47421

Jun 27, 2023

Researcher: Cat

ApplyOnline – Application Form Builder and Manager <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-24391

Jun 26, 2023

Researcher: yuyudhn

Floating Chat Widget - Chaty <= 3.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-3245

Jun 26, 2023

Researcher: Dipak Panchal (th3.d1p4k)

About Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-3369

Jun 22, 2023

Researcher: Marco Wotschka

Customer Service Software & Support Ticket System <= 5.12.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE ID Unknown

Jun 22, 2023

Researchers:

Extra User Details <= 0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-35878

Jun 19, 2023

Researcher: LEE SE HYOUNG

Image Protector <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-2026

Jun 19, 2023

Researcher: Shreya Pohekar

Title	CVE ID	CVSS	Researchers	Date
WP-Cirrus <= 0.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-36692	4.4	LEE SE HYOUNG	July 4, 2023
Reservation.Studio widget <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-24397	4.4	Nithissh S	July 4, 2023
Simple Site Verify <= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-36688	4.4	yuyudhn	July 4, 2023
Mobile Call Now & Map Buttons <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-24401	4.4	Abdi Pranata	July 4, 2023
All-in-one Floating Contact Form <= 2.1.1 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings	CVE-2023-3248	4.4	Dipak Panchal (th3.d1p4k)	July 3, 2023
Auto Location for WP Job Manager via Google <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting	CVE-2023-3344	4.4	Bob Matyas	July 3, 2023
Knowledge Center <= 2.7 - Authenticated (Admin+) Cross-Site Scripting		4.4		June 30, 2023
My Content Management <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-34377	4.4	emad	June 30, 2023
SP Project & Document Manager <= 4.67 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings	CVE-2023-36530	4.4	emad	June 30, 2023
Short URL <= 1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting	CVE-2023-1602	4.4	Etan Imanol Castro Aldrete	June 28, 2023
Side Cart Woocommerce (Ajax) <= 2.2 Authenticated(Administrator+) Stored Cross-Site Scripting	CVE-2023-28415	4.4	Yuki Haruma	June 28, 2023
Catalyst Connect Zoho CRM Client Portal <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-44629	4.4	Hoang Van Hiep	June 27, 2023
WP Abstracts <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-28692	4.4	qilin_99	June 27, 2023
ARMember <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2022-47421	4.4	Cat	June 27, 2023
ApplyOnline – Application Form Builder and Manager <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-24391	4.4	yuyudhn	June 26, 2023
Floating Chat Widget - Chaty <= 3.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-3245	4.4	Dipak Panchal (th3.d1p4k)	June 26, 2023
About Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-3369	4.4	Marco Wotschka	June 22, 2023
Customer Service Software & Support Ticket System <= 5.12.0 - Authenticated (Administrator+) Stored Cross-Site Scripting		4.4		June 22, 2023
Extra User Details <= 0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-35878	4.4	LEE SE HYOUNG	June 19, 2023
Image Protector <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2023-2026	4.4	Shreya Pohekar	June 19, 2023

Submit Vulnerability

«
‹
1
2
...
887
888
889
...
1042
1043
›
»

Researcher Hall of Fame (Past 30 days)

View All

Rank	Name	Vulnerabilities since Nov 11, 2024 Vulns
1	SOPROBRO	75
2	Peter Thaleikis	65
3	vgo0	62
4	Francesco Carlucci	52
5	João Pedro Soares de Alcântara	23
6	Mika	22
7	stealthcopter	16
8	Arkadiusz Hydzik	14
9	Tieu Pham Trong Nhan	14
10	Colin Xu	12
11	LVT-tholv2k	11
12	zakaria	10
13	István Márton	10
14	zer0gh0st	10
15	Tonn	10
16	mikemyers	9
17	theviper17y	9
18	Le Ngoc Anh	8
19	Webbernaut	7
20	Gab	7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation