WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection
8.8
CVE-2024-1685
Mar 15, 2024
Researcher: Francesco Carlucci
MJM Clinic <= 1.1.22 - Authenticated (Editor+) Stored Cross-Site Scripting
5.5
CVE-2024-29096
Mar 15, 2024
Researcher: Faizal Abroni
Database for Contact Form 7 <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-29103
Mar 15, 2024
Researcher: RE-ALTER
WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-27989
Mar 15, 2024
Researcher: LVT-tholv2k
WEN Responsive Columns <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-27988
Mar 15, 2024
Researcher: LVT-tholv2k
WP Armour – Honeypot Anti Spam <= 2.1.13 - Reflected Cross-Site Scripting
6.1
CVE-2024-29091
Mar 15, 2024
Researcher: Rafie Muhammad
Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal
4.9
CVE-2024-2294
Mar 15, 2024
Researcher: Dau Hoang Tai
ElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
6.4
CVE-2024-2042
Mar 15, 2024
Researcher: wesley (wcraft)
Survey Maker <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-27996
Mar 15, 2024
Researcher: Joel Indra
Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-29102
Mar 15, 2024
Researcher: RE-ALTER
Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-2287
Mar 15, 2024
Researcher: Tien Luong
Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Reflected Cross-Site Scripting
6.1
CVE-2024-27998
Mar 15, 2024
Researcher: Maksim Kosenko
HT Easy GA4 ( Google Analytics 4 ) <= 1.1.7 - Reflected Cross-Site Scripting
6.1
CVE-2024-29094
Mar 15, 2024
Researcher: beluga
Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure
5.3
CVE-2024-1857
Mar 15, 2024
Researcher: Krzysztof Zając
YITH WooCommerce Product Add-Ons <= 4.5.0 - Unuathenticated Cross-Site Scripting
6.1
CVE-2024-27994
Mar 15, 2024
Researcher: beluga
Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url
7.2
CVE-2024-1812
Mar 15, 2024
Researcher: hir0ot
Calendarista Basic Edition <= 3.0.2 - Unauthenticated Cross-Site Scripting
6.1
CVE-2024-27993
Mar 15, 2024
Researcher: Mochamad Sofyan
The Moneytizer <= 9.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-27990
Mar 15, 2024
Researcher: LVT-tholv2k
ARMember <= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-27995
Mar 15, 2024
Researcher: Van Lyubov
Five Star Restaurant Menu <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-29089
Mar 15, 2024
Researcher: Steven Julian
Title CVE ID CVSS Researchers Date
Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection CVE-2024-1685 8.8 Francesco Carlucci March 15, 2024
MJM Clinic <= 1.1.22 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-29096 5.5 Faizal Abroni March 15, 2024
Database for Contact Form 7 <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-29103 6.4 RE-ALTER March 15, 2024
WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-27989 6.4 LVT-tholv2k March 15, 2024
WEN Responsive Columns <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-27988 6.4 LVT-tholv2k March 15, 2024
WP Armour – Honeypot Anti Spam <= 2.1.13 - Reflected Cross-Site Scripting CVE-2024-29091 6.1 Rafie Muhammad March 15, 2024
Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal CVE-2024-2294 4.9 Dau Hoang Tai March 15, 2024
ElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget CVE-2024-2042 6.4 wesley (wcraft) March 15, 2024
Survey Maker <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-27996 4.4 Joel Indra March 15, 2024
Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting CVE-2024-29102 7.2 RE-ALTER March 15, 2024
Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-2287 6.4 Tien Luong March 15, 2024
Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Reflected Cross-Site Scripting CVE-2024-27998 6.1 Maksim Kosenko March 15, 2024
HT Easy GA4 ( Google Analytics 4 ) <= 1.1.7 - Reflected Cross-Site Scripting CVE-2024-29094 6.1 beluga March 15, 2024
Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure CVE-2024-1857 5.3 Krzysztof Zając March 15, 2024
YITH WooCommerce Product Add-Ons <= 4.5.0 - Unuathenticated Cross-Site Scripting CVE-2024-27994 6.1 beluga March 15, 2024
Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url CVE-2024-1812 7.2 hir0ot March 15, 2024
Calendarista Basic Edition <= 3.0.2 - Unauthenticated Cross-Site Scripting CVE-2024-27993 6.1 Mochamad Sofyan March 15, 2024
The Moneytizer <= 9.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-27990 6.4 LVT-tholv2k March 15, 2024
ARMember <= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-27995 4.4 Van Lyubov March 15, 2024
Five Star Restaurant Menu <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-29089 6.4 Steven Julian March 15, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Dec 18, 2024
Vulns
1 SOPROBRO 82
2 vgo0 51
3 João Pedro Soares de Alcântara 40
4 Peter Thaleikis 27
5 Lucio Sá 26
6 zaim 19
7 Mika 17
8 Hassan Khan Yusufzai - Splint3r7 17
9 yudha 16
10 Rafie Muhammad 16
11 0xd4rk5id3 14
12 Francesco Carlucci 14
13 Bob Matyas 12
14 Webbernaut 11
15 theviper17y 11
16 Tieu Pham Trong Nhan 10
17 Le Ngoc Anh 10
18 stealthcopter 10
19 Bonds 9
20 Colin Xu 9

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation