WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-8621
Sep 24, 2024
Researcher: Krzysztof Zając
WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-8436
Sep 23, 2024
Researcher: Lucio Sá
MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-8624
Sep 23, 2024
Researcher: Krzysztof Zając
Super Store Finder <= 6.9.7 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-43976
Aug 28, 2024
Researcher: Seb
Woocommerce Addon by Greenshift< 1.9.8 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-43943
Aug 26, 2024
Researcher: Dave Jong
Greenshift Query and Meta Addon < 3.9.2 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-43942
Aug 26, 2024
Researcher: Dave Jong
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
9.9
CVE-2024-6386
Aug 21, 2024
Researcher: stealthcopter
Unite Gallery Lite <= 1.7.62 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-43207
Aug 9, 2024
Researcher: João Pedro Soares de Alcântara
GeoDirectory <= 2.3.61 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-43145
Aug 7, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
Event Manager for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Local File Inclusion
9.9
CVE-2024-43138
Aug 7, 2024
Researcher: João G. Barbosa (4rCanJ0x!)
Registrations for the Events Calendar – Event Registration Plugin <= 2.12.2 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-39638
Jul 30, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
ListingPro Plugin <= 2.9.4 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-39620
Jul 22, 2024
Researcher: Rafie Muhammad
DirectoryPress <= 3.6.10 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-38755
Jul 11, 2024
Researcher: Peng Zhou
PayPlus Payment Gateway <= 7.0.7 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-37564
Jul 9, 2024
Researcher: LVT-tholv2k
OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-3604
Jul 8, 2024
Researcher: Krzysztof Zając
Youzify <= 1.2.5 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-37494
Jul 4, 2024
Researcher: LVT-tholv2k
Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVE-2024-37420
Jun 28, 2024
Researcher: Majed Refaea
Newspack Blocks <= 3.0.8 - Authenticated (Contributor+) Arbitrary File Upload
9.9
CVE-2024-37424
Jun 28, 2024
Researcher: Rafie Muhammad
Zoho Marketing Automation <= 1.2.7 - Authenticated (Contributor+) SQL Injection
9.9
CVE-2024-37225
Jun 21, 2024
Researcher: LVT-tholv2k
WishList Member X < 3.26.7 - Authenticated (Subscriber+) Remote Code Execution
9.9
CVE-2024-37109
Jun 20, 2024
Researcher: Dave Jong
Title CVE ID CVSS Researchers Date
Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection CVE-2024-8621 9.9 Krzysztof Zając September 24, 2024
WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection CVE-2024-8436 9.9 Lucio Sá September 23, 2024
MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection CVE-2024-8624 9.9 Krzysztof Zając September 23, 2024
Super Store Finder <= 6.9.7 - Authenticated (Subscriber+) SQL Injection CVE-2024-43976 9.9 Seb August 28, 2024
Woocommerce Addon by Greenshift< 1.9.8 - Authenticated (Subscriber+) SQL Injection CVE-2024-43943 9.9 Dave Jong August 26, 2024
Greenshift Query and Meta Addon < 3.9.2 - Authenticated (Subscriber+) SQL Injection CVE-2024-43942 9.9 Dave Jong August 26, 2024
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection CVE-2024-6386 9.9 stealthcopter August 21, 2024
Unite Gallery Lite <= 1.7.62 - Authenticated (Contributor+) SQL Injection CVE-2024-43207 9.9 João Pedro Soares de Alcântara August 9, 2024
GeoDirectory <= 2.3.61 - Authenticated (Subscriber+) SQL Injection CVE-2024-43145 9.9 Trương Hữu Phúc (truonghuuphuc) August 7, 2024
Event Manager for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Local File Inclusion CVE-2024-43138 9.9 João G. Barbosa (4rCanJ0x!) August 7, 2024
Registrations for the Events Calendar – Event Registration Plugin <= 2.12.2 - Authenticated (Contributor+) SQL Injection CVE-2024-39638 9.9 Trương Hữu Phúc (truonghuuphuc) July 30, 2024
ListingPro Plugin <= 2.9.4 - Authenticated (Subscriber+) SQL Injection CVE-2024-39620 9.9 Rafie Muhammad July 22, 2024
DirectoryPress <= 3.6.10 - Authenticated (Contributor+) SQL Injection CVE-2024-38755 9.9 Peng Zhou July 11, 2024
PayPlus Payment Gateway <= 7.0.7 - Authenticated (Subscriber+) SQL Injection CVE-2024-37564 9.9 LVT-tholv2k July 9, 2024
OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection CVE-2024-3604 9.9 Krzysztof Zając July 8, 2024
Youzify <= 1.2.5 - Authenticated (Contributor+) SQL Injection CVE-2024-37494 9.9 LVT-tholv2k July 4, 2024
Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-37420 9.9 Majed Refaea June 28, 2024
Newspack Blocks <= 3.0.8 - Authenticated (Contributor+) Arbitrary File Upload CVE-2024-37424 9.9 Rafie Muhammad June 28, 2024
Zoho Marketing Automation <= 1.2.7 - Authenticated (Contributor+) SQL Injection CVE-2024-37225 9.9 LVT-tholv2k June 21, 2024
WishList Member X < 3.26.7 - Authenticated (Subscriber+) Remote Code Execution CVE-2024-37109 9.9 Dave Jong June 20, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 9, 2026
Vulns
1 Wordfence PRISM 66
2 daroo 46
3 Ananda Dhakal 40
4 Jakub Herman 27
5 Erwan LR 23
6 dutafi 21
7 Asim Alshaya 20
8 Tran Nguyen Bao Khanh 17
9 Shikhali Jamalzade 14
10 Muni Nitish Kumar Yaddala 14
11 Osvaldo Noe Gonzalez Del Rio (Os) 12
12 Nabil Irawan 10
13 Farid Narimanov 10
14 Sai Praneeth Koti 10
15 Dmitrii Ignatyev 9
16 Pedro Pinho 9
17 Revanth Hari Narayana Matte 9
18 JunHee CHO 7
19 Shivamani Vastrala 7
20 Meher Sudhakar Abbireddi 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation