WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
AI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
6.3
CVE-2024-13361
Jan 21, 2025
Researcher: mikemyers
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-13584
Jan 21, 2025
Researcher: Peter Thaleikis
WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload
9.8
CVE-2024-13091
Jan 21, 2025
Researcher: István Márton
XML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scripting
6.1
CVE-2024-13406
Jan 21, 2025
Researcher: Le Ngoc Anh
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts
7.2
CVE-2025-0428
Jan 21, 2025
Researcher: Tran Anh Duc
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery
5.4
CVE-2024-13360
Jan 21, 2025
Researcher: shaman0x01
Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-13319
Jan 21, 2025
Researcher: Colin Xu
WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation
4.3
CVE-2024-12879
Jan 21, 2025
Researcher: BrokenAC ignore
Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-12117
Jan 21, 2025
Researcher: zer0gh0st
FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
6.4
CVE-2024-11226
Jan 20, 2025
Researcher: Peter Thaleikis
Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'
5.3
CVE-2024-13230
Jan 20, 2025
Researcher: mikemyers
Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
6.4
CVE-2025-0450
Jan 20, 2025
Researcher: stealthcopter
wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-13444
Jan 20, 2025
Researcher: SOPROBRO
WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting
6.1
CVE-2024-12005
Jan 20, 2025
Researcher: vgo0
Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
6.4
CVE-2025-0371
Jan 20, 2025
Researcher: stealthcopter
1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure
5.3
CVE-2024-13536
Jan 20, 2025
Researcher: stealthcopter
aDirectory – WordPress Directory Listing Plugin <= 1.6.5 - Unauthenticated PHP Object Injection
7.5
CVE ID Unknown
Jan 20, 2025
Researchers:
String Locator <= 2.6.6 - Unauthenticated PHP Object Injection
8.8
CVE-2024-10936
Jan 20, 2025
Researcher: Webbernaut
Link Library <= 7.7.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-13404
Jan 20, 2025
Researcher: Colin Xu
Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion
5.3
CVE-2024-12104
Jan 20, 2025
Researchers: Tieu Pham Trong Nhan, BrokenAC ignore
Title CVE ID CVSS Researchers Date
AI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2024-13361 6.3 mikemyers January 21, 2025
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-13584 6.4 Peter Thaleikis January 21, 2025
WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload CVE-2024-13091 9.8 István Márton January 21, 2025
XML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scripting CVE-2024-13406 6.1 Le Ngoc Anh January 21, 2025
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts CVE-2025-0428 7.2 Tran Anh Duc January 21, 2025
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2024-13360 5.4 shaman0x01 January 21, 2025
Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting CVE-2024-13319 6.1 Colin Xu January 21, 2025
WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation CVE-2024-12879 4.3 BrokenAC ignore January 21, 2025
Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-12117 6.4 zer0gh0st January 21, 2025
FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter CVE-2024-11226 6.4 Peter Thaleikis January 20, 2025
Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey' CVE-2024-13230 5.3 mikemyers January 20, 2025
Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS CVE-2025-0450 6.4 stealthcopter January 20, 2025
wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-13444 6.1 SOPROBRO January 20, 2025
WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting CVE-2024-12005 6.1 vgo0 January 20, 2025
Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2025-0371 6.4 stealthcopter January 20, 2025
1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure CVE-2024-13536 5.3 stealthcopter January 20, 2025
aDirectory – WordPress Directory Listing Plugin <= 1.6.5 - Unauthenticated PHP Object Injection 7.5 January 20, 2025
String Locator <= 2.6.6 - Unauthenticated PHP Object Injection CVE-2024-10936 8.8 Webbernaut January 20, 2025
Link Library <= 7.7.2 - Reflected Cross-Site Scripting CVE-2024-13404 6.1 Colin Xu January 20, 2025
Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion CVE-2024-12104 5.3 Tieu Pham Trong Nhan, BrokenAC ignore January 20, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Dec 24, 2024
Vulns
1 SOPROBRO 260
2 João Pedro Soares de Alcântara 69
3 Mika 46
4 vgo0 43
5 0xd4rk5id3 34
6 Peter Thaleikis 24
7 Lucio Sá 23
8 Le Ngoc Anh 21
9 zaim 17
10 Hassan Khan Yusufzai - Splint3r7 16
11 LVT-tholv2k 16
12 Colin Xu 15
13 akas wisnu aji 14
14 stealthcopter 14
15 Trương Hữu Phúc (truonghuuphuc) 14
16 yudha 13
17 Bob Matyas 12
18 Webbernaut 11
19 Dhabaleshwar Das 10
20 theviper17y 10

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation