WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Global Gallery <= 8.8.0 - Reflected Cross-Site Scripting
6.1
CVE-2025-22263
Apr 7, 2025
Researcher: Bonds
Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2025-32215
Apr 7, 2025
Researcher: theviper17y
5sterrenspecialist <= 1.4 - Reflected Cross-Site Scripting
6.1
CVE-2025-32114
Apr 7, 2025
Researcher: Le Ngoc Anh
CM Registration and Invitation Codes <= 2.5.5 - Missing Authorization
4.3
CVE-2025-32210
Apr 7, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Nomupay Payment Processing Gateway <= 7.1.5 - Authenticated (Subscriber+) Arbitrary File Download
8.1
CVE-2025-32209
Apr 7, 2025
Researcher: LVT-tholv2k
Internal Link Optimiser <= 5.1.2 - Missing Authorization to Unauthenticated Settings Update
5.3
CVE-2025-32243
Apr 7, 2025
Researcher: Kévin Mosbahi (Mika)
3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material_text'
4.9
CVE-2025-3429
Apr 7, 2025
Researchers: Jon Cagan, VigilAInce Seeker
QR Master <= 1.0.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-32116
Apr 7, 2025
Researcher: SOPROBRO
3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text'
4.9
CVE-2025-3427
Apr 7, 2025
Researchers: Jon Cagan, VigilAInce Seeker
Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
8.8
CVE-2025-2526
Apr 7, 2025
Researcher: István Márton
Admin and Site Enhancements (ASE) <= 7.6.9 - Password Protection Bypass
5.3
CVE-2024-13688
Apr 7, 2025
Researcher: Dogus Demirkiran
Widgetize Pages Light <= 3.0 & Widgets as Shortcodes <= 5.9.10 - Reflected Cross-Site Scripting
6.1
CVE-2025-32117
Apr 7, 2025
Researcher: SOPROBRO
WordPress Tag, Category, and Taxonomy Manager – AI Autotagger <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-0627
Apr 7, 2025
Researcher: Dmitrii Ignatyev
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update
5.3
CVE-2025-2568
Apr 7, 2025
Researcher: kr0d
AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2025-3432
Apr 7, 2025
Researcher: Pierre Rudloff
Broken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2025-1264
Apr 5, 2025
Researcher: Christiaan Swiers (YouGina)
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move
9.8
CVE-2025-2941
Apr 4, 2025
Researcher: Phat RiO
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation
8.1
CVE-2024-13776
Apr 4, 2025
Researcher: Lucio Sá
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion
5.3
CVE-2025-2789
Apr 4, 2025
Researcher: Brian Sans-Souci (liardom)
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
7.5
CVE-2024-13604
Apr 4, 2025
Researcher: Tim Coen
Title CVE ID CVSS Researchers Date
Global Gallery <= 8.8.0 - Reflected Cross-Site Scripting CVE-2025-22263 6.1 Bonds April 7, 2025
Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2025-32215 8.8 theviper17y April 7, 2025
5sterrenspecialist <= 1.4 - Reflected Cross-Site Scripting CVE-2025-32114 6.1 Le Ngoc Anh April 7, 2025
CM Registration and Invitation Codes <= 2.5.5 - Missing Authorization CVE-2025-32210 4.3 Trương Hữu Phúc (truonghuuphuc) April 7, 2025
Nomupay Payment Processing Gateway <= 7.1.5 - Authenticated (Subscriber+) Arbitrary File Download CVE-2025-32209 8.1 LVT-tholv2k April 7, 2025
Internal Link Optimiser <= 5.1.2 - Missing Authorization to Unauthenticated Settings Update CVE-2025-32243 5.3 Kévin Mosbahi (Mika) April 7, 2025
3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material_text' CVE-2025-3429 4.9 Jon Cagan, VigilAInce Seeker April 7, 2025
QR Master <= 1.0.5 - Reflected Cross-Site Scripting CVE-2025-32116 6.1 SOPROBRO April 7, 2025
3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text' CVE-2025-3427 4.9 Jon Cagan, VigilAInce Seeker April 7, 2025
Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover CVE-2025-2526 8.8 István Márton April 7, 2025
Admin and Site Enhancements (ASE) <= 7.6.9 - Password Protection Bypass CVE-2024-13688 5.3 Dogus Demirkiran April 7, 2025
Widgetize Pages Light <= 3.0 & Widgets as Shortcodes <= 5.9.10 - Reflected Cross-Site Scripting CVE-2025-32117 6.1 SOPROBRO April 7, 2025
WordPress Tag, Category, and Taxonomy Manager – AI Autotagger <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-0627 4.4 Dmitrii Ignatyev April 7, 2025
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update CVE-2025-2568 5.3 kr0d April 7, 2025
AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2025-3432 6.4 Pierre Rudloff April 7, 2025
Broken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL Injection CVE-2025-1264 6.5 Christiaan Swiers (YouGina) April 5, 2025
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move CVE-2025-2941 9.8 Phat RiO April 4, 2025
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation CVE-2024-13776 8.1 Lucio Sá April 4, 2025
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion CVE-2025-2789 5.3 Brian Sans-Souci (liardom) April 4, 2025
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory CVE-2024-13604 7.5 Tim Coen April 4, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 13, 2026
Vulns
1 Ananda Dhakal 168
2 Wordfence PRISM 68
3 Intrudify 46
4 Jakub Herman 32
5 Karthik Ramakrishnan 31
6 Artus KG 31
7 nh4tvd 31
8 Rafie Muhammad 19
9 daroo 19
10 Iñigo Sánchez Enciso 18
11 Francisco José Ramírez Vicente 18
12 Pablo González Pérez 18
13 neurotx 18
14 Erwan LR 17
15 Supakiad S. (m3ez) 16
16 JunHee CHO 16
17 Peter Tang 16
18 vuxvinh 15
19 Kuba 15
20 Naoki Kawahigashi 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation