WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
6.5
CVE-2025-2719
Apr 9, 2025
Researcher: kr0d
SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
8.1
CVE-2025-3102
Apr 9, 2025
Researcher: mikemyers
Advanced Tag Lists <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32476
Apr 9, 2025
Researcher: johska
More Mime Type Filters <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-31394
Apr 9, 2025
Researcher: johska
SEO Help <= 6.6.1 - Authenticated (Admin+) Server-Side Request Forgery
5.5
CVE-2025-32675
Apr 9, 2025
Researcher: Phan Trong Quan
WP Show Stats <= 1.5 - Cross-Site Request Forgery
4.3
CVE-2025-32678
Apr 9, 2025
Researcher: Nabil Irawan
Site Table of Contents <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-31385
Apr 9, 2025
Researcher: johska
MMX &#8211; Make Me Christmas <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-31401
Apr 9, 2025
Researcher: johska
Mergado Pack <= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32669
Apr 9, 2025
Researcher: Nguyen Xuan Chien
ALD Login Page <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32518
Apr 9, 2025
Researcher: SOPROBRO
Age Gate <= 3.5.4 - Missing Authorization
5.3
CVE-2025-31012
Apr 9, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Language Field <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-31382
Apr 9, 2025
Researcher: johska
Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32482
Apr 9, 2025
Researcher: johska
Aria Font <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-32488
Apr 9, 2025
Researcher: Nabil Irawan
WP Social Stream Designer <= 1.3 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-32677
Apr 9, 2025
Researcher: Phan Trong Quan
Photography <= 7.5.2 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2025-30964
Apr 9, 2025
Researcher: Rafie Muhammad
VKontakte Cross-Post <= 0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32498
Apr 9, 2025
Researcher: johska
Wishlist <= 1.0.44 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-32618
Apr 9, 2025
Researcher: NAWardRox
Comment Validation Reloaded <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-31026
Apr 9, 2025
Researcher: johska
Duplicate Title Checker <= 1.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-32558
Apr 9, 2025
Researcher: João Pedro Soares de Alcântara
Title CVE ID CVSS Researchers Date
Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update CVE-2025-2719 6.5 kr0d April 9, 2025
SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation CVE-2025-3102 8.1 mikemyers April 9, 2025
Advanced Tag Lists <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32476 6.1 johska April 9, 2025
More Mime Type Filters <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-31394 6.1 johska April 9, 2025
SEO Help <= 6.6.1 - Authenticated (Admin+) Server-Side Request Forgery CVE-2025-32675 5.5 Phan Trong Quan April 9, 2025
WP Show Stats <= 1.5 - Cross-Site Request Forgery CVE-2025-32678 4.3 Nabil Irawan April 9, 2025
Site Table of Contents <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-31385 6.1 johska April 9, 2025
MMX &#8211; Make Me Christmas <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-31401 6.1 johska April 9, 2025
Mergado Pack <= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32669 6.1 Nguyen Xuan Chien April 9, 2025
ALD Login Page <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32518 6.1 SOPROBRO April 9, 2025
Age Gate <= 3.5.4 - Missing Authorization CVE-2025-31012 5.3 Trương Hữu Phúc (truonghuuphuc) April 9, 2025
Language Field <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-31382 6.1 johska April 9, 2025
Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32482 6.1 johska April 9, 2025
Aria Font <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-32488 4.4 Nabil Irawan April 9, 2025
WP Social Stream Designer <= 1.3 - Authenticated (Administrator+) SQL Injection CVE-2025-32677 4.9 Phan Trong Quan April 9, 2025
Photography <= 7.5.2 - Unauthenticated Server-Side Request Forgery CVE-2025-30964 7.2 Rafie Muhammad April 9, 2025
VKontakte Cross-Post <= 0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32498 6.1 johska April 9, 2025
Wishlist <= 1.0.44 - Authenticated (Subscriber+) SQL Injection CVE-2025-32618 6.5 NAWardRox April 9, 2025
Comment Validation Reloaded <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-31026 6.1 johska April 9, 2025
Duplicate Title Checker <= 1.2 - Authenticated (Subscriber+) SQL Injection CVE-2025-32558 6.5 João Pedro Soares de Alcântara April 9, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 10, 2026
Vulns
1 Ananda Dhakal 171
2 Wordfence PRISM 68
3 Intrudify 46
4 Artus KG 36
5 Karthik Ramakrishnan 34
6 Jakub Herman 33
7 nh4tvd 32
8 Rafie Muhammad 19
9 daroo 19
10 Francisco José Ramírez Vicente 18
11 JunHee CHO 18
12 Pablo González Pérez 18
13 Iñigo Sánchez Enciso 18
14 neurotx 18
15 Erwan LR 18
16 Peter Tang 16
17 Supakiad S. (m3ez) 16
18 Naoki Kawahigashi 15
19 vuxvinh 15
20 Kuba 15

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation