WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-26964
Feb 23, 2025
Researcher: Peter Thaleikis
GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-1620
Feb 23, 2025
Researcher: Dmitrii Ignatyev
Countdown Timer <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-26938
Feb 23, 2025
Researcher: Logan Cote
WP Yelp Review Slider <= 8.1 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-26946
Feb 23, 2025
Researcher: Phat RiO
Info Cards – Gutenberg block for creating Beautiful Cards <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-26945
Feb 23, 2025
Researcher: Logan Cote
WP Multistore Locator <= 2.5.1 - Unauthenticated SQL Injection
7.5
CVE-2025-26974
Feb 23, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Market Exporter <= 2.0.21 - Missing Authorization
5.4
CVE-2025-26995
Feb 23, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
WC Place Order Without Payment <= 2.6.7 - Unauthenticated Local File Inclusion
9.8
CVE-2025-26933
Feb 23, 2025
Researcher: Dimas Maulana
WP Responsive Auto Fit Text <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-26904
Feb 23, 2025
Researcher: theviper17y
Easy Quotes <= 1.2.2 - Unauthenticated SQL Injection
7.5
CVE-2025-26943
Feb 23, 2025
Researcher: NAWardRox
Poll Maker <= 5.6.5 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-26971
Feb 23, 2025
Researcher: Webula
Poll Maker <= 5.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-13602
Feb 23, 2025
Researcher: Krugov Artyom
ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-26932
Feb 23, 2025
Researcher: Peter Thaleikis
Atarim <= 4.1.0 - Reflected Cross-Site Scripting
6.1
CVE-2025-26993
Feb 23, 2025
Researcher: Dimas Maulana
Amelia <= 1.2.16 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2025-26965
Feb 23, 2025
Researcher: Revan Arifio
Web Accessibility By accessiBe <= 2.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-26981
Feb 23, 2025
Researcher: Dimas Maulana
GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-1622
Feb 23, 2025
Researcher: Dmitrii Ignatyev
WP Templata <= 1.0.7 - Reflected Cross-Site Scripting
6.1
CVE-2025-26917
Feb 23, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Easy Elementor Addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-26912
Feb 23, 2025
Researcher: Prissy
GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-1621
Feb 23, 2025
Researcher: Dmitrii Ignatyev
Title CVE ID CVSS Researchers Date
Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion CVE-2025-26964 8.8 Peter Thaleikis February 23, 2025
GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-1620 4.4 Dmitrii Ignatyev February 23, 2025
Countdown Timer <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-26938 6.4 Logan Cote February 23, 2025
WP Yelp Review Slider <= 8.1 - Authenticated (Administrator+) SQL Injection CVE-2025-26946 4.9 Phat RiO February 23, 2025
Info Cards – Gutenberg block for creating Beautiful Cards <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-26945 6.4 Logan Cote February 23, 2025
WP Multistore Locator <= 2.5.1 - Unauthenticated SQL Injection CVE-2025-26974 7.5 Trương Hữu Phúc (truonghuuphuc) February 23, 2025
Market Exporter <= 2.0.21 - Missing Authorization CVE-2025-26995 5.4 Trương Hữu Phúc (truonghuuphuc) February 23, 2025
WC Place Order Without Payment <= 2.6.7 - Unauthenticated Local File Inclusion CVE-2025-26933 9.8 Dimas Maulana February 23, 2025
WP Responsive Auto Fit Text <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-26904 6.4 theviper17y February 23, 2025
Easy Quotes <= 1.2.2 - Unauthenticated SQL Injection CVE-2025-26943 7.5 NAWardRox February 23, 2025
Poll Maker <= 5.6.5 - Authenticated (Administrator+) SQL Injection CVE-2025-26971 4.9 Webula February 23, 2025
Poll Maker <= 5.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-13602 4.4 Krugov Artyom February 23, 2025
ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion CVE-2025-26932 8.8 Peter Thaleikis February 23, 2025
Atarim <= 4.1.0 - Reflected Cross-Site Scripting CVE-2025-26993 6.1 Dimas Maulana February 23, 2025
Amelia <= 1.2.16 - Unauthenticated Insecure Direct Object Reference CVE-2025-26965 5.3 Revan Arifio February 23, 2025
Web Accessibility By accessiBe <= 2.5 - Reflected Cross-Site Scripting CVE-2025-26981 6.1 Dimas Maulana February 23, 2025
GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-1622 4.4 Dmitrii Ignatyev February 23, 2025
WP Templata <= 1.0.7 - Reflected Cross-Site Scripting CVE-2025-26917 6.1 Trương Hữu Phúc (truonghuuphuc) February 23, 2025
Easy Elementor Addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-26912 6.4 Prissy February 23, 2025
GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-1621 4.4 Dmitrii Ignatyev February 23, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 13, 2026
Vulns
1 Wordfence PRISM 89
2 Ananda Dhakal 56
3 daroo 49
4 Jakub Herman 38
5 Erwan LR 27
6 dutafi 25
7 Revanth Hari Narayana Matte 21
8 Shikhali Jamalzade 17
9 Asim Alshaya 16
10 Tran Nguyen Bao Khanh 15
11 Muni Nitish Kumar Yaddala 14
12 Sai Praneeth Koti 13
13 Artus KG 13
14 Osvaldo Noe Gonzalez Del Rio (Os) 12
15 Nabil Irawan 12
16 Supakiad S. (m3ez) (m3ez) 11
17 sungbyeongchan 10
18 Dmitrii Ignatyev 9
19 Shivamani Vastrala 8
20 Mohammed Abd Alrahman 8

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation