WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-13381
Apr 9, 2025
Researcher: Dmitrii Ignatyev
WordPress SMTP Service, Email Delivery Solved! — MailHawk <= 1.3.1 - Unauthenticated Local File Inclusion
9.8
CVE-2025-31015
Apr 9, 2025
Researcher: Nguyen Xuan Chien
Sandwich Adsense <= 4.0.2 - Missing Authorization
5.3
CVE-2025-31042
Apr 9, 2025
Researcher: timomangcut
Easy Post Duplicator <= 1.0.1 - Reflected Cross-Site Scripting
6.1
CVE-2025-32538
Apr 9, 2025
Researcher: Le Ngoc Anh
Review Stars Count For WooCommerce <= 2.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-32687
Apr 9, 2025
Researcher: Phúc ton luoi
Request Call Back <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-32483
Apr 9, 2025
Researcher: Nabil Irawan
Job Board Manager <= 2.1.60 - Authenticated (Contributor+) PHP Object Injection
8.8
CVE-2025-32144
Apr 9, 2025
Researcher: LVT-tholv2k
Brizy Pro <= 2.8.0 - Cross-Site Request Forgery
4.3
CVE-2025-26902
Apr 9, 2025
Researcher: Rafie Muhammad
WPJobBoard < 5.11.1 - Cross-Site Request Forgery
4.3
CVE-2025-30965
Apr 9, 2025
Researcher: Ananda Dhakal
RentSyst <= 2.0.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32501
Apr 9, 2025
Researcher: SOPROBRO
BP Social Connect <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-32493
Apr 9, 2025
Researcher: Nabil Irawan
WordPress Events Calendar Plugin – connectDaily <= 1.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32597
Apr 9, 2025
Researcher: Dhabaleshwar Das
Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-32650
Apr 9, 2025
Researcher: Phúc ton luoi
KeyCAPTCHA <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32619
Apr 9, 2025
Researcher: Abdi Pranata
Rich Table of Contents <= 1.4.0 - Missing Authorization
4.3
CVE-2025-31004
Apr 9, 2025
Researcher: Peter Thaleikis
Ultimate WP Mail <= 1.3.9 - Open Redirect
6.1
CVE-2025-32694
Apr 9, 2025
Researcher: Le Ngoc Anh
Codescar Radio Widget <= 0.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32500
Apr 9, 2025
Researcher: SOPROBRO
WP Table Builder <= 2.0.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-32598
Apr 9, 2025
Researcher: Peter Thaleikis
WP Calais Auto Tagger <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-32563
Apr 9, 2025
Researcher: SOPROBRO
Customize Login Page <= 1.1 - Cross-Site Request Forgery
4.3
CVE-2025-31034
Apr 9, 2025
Researcher: Skalucy
Title CVE ID CVSS Researchers Date
Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-13381 4.4 Dmitrii Ignatyev April 9, 2025
WordPress SMTP Service, Email Delivery Solved! — MailHawk <= 1.3.1 - Unauthenticated Local File Inclusion CVE-2025-31015 9.8 Nguyen Xuan Chien April 9, 2025
Sandwich Adsense <= 4.0.2 - Missing Authorization CVE-2025-31042 5.3 timomangcut April 9, 2025
Easy Post Duplicator <= 1.0.1 - Reflected Cross-Site Scripting CVE-2025-32538 6.1 Le Ngoc Anh April 9, 2025
Review Stars Count For WooCommerce <= 2.0 - Authenticated (Subscriber+) SQL Injection CVE-2025-32687 6.5 Phúc ton luoi April 9, 2025
Request Call Back <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-32483 4.4 Nabil Irawan April 9, 2025
Job Board Manager <= 2.1.60 - Authenticated (Contributor+) PHP Object Injection CVE-2025-32144 8.8 LVT-tholv2k April 9, 2025
Brizy Pro <= 2.8.0 - Cross-Site Request Forgery CVE-2025-26902 4.3 Rafie Muhammad April 9, 2025
WPJobBoard < 5.11.1 - Cross-Site Request Forgery CVE-2025-30965 4.3 Ananda Dhakal April 9, 2025
RentSyst <= 2.0.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32501 6.1 SOPROBRO April 9, 2025
BP Social Connect <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-32493 4.4 Nabil Irawan April 9, 2025
WordPress Events Calendar Plugin – connectDaily <= 1.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32597 6.1 Dhabaleshwar Das April 9, 2025
Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) SQL Injection CVE-2025-32650 6.5 Phúc ton luoi April 9, 2025
KeyCAPTCHA <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32619 6.1 Abdi Pranata April 9, 2025
Rich Table of Contents <= 1.4.0 - Missing Authorization CVE-2025-31004 4.3 Peter Thaleikis April 9, 2025
Ultimate WP Mail <= 1.3.9 - Open Redirect CVE-2025-32694 6.1 Le Ngoc Anh April 9, 2025
Codescar Radio Widget <= 0.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32500 6.1 SOPROBRO April 9, 2025
WP Table Builder <= 2.0.5 - Reflected Cross-Site Scripting CVE-2025-32598 6.1 Peter Thaleikis April 9, 2025
WP Calais Auto Tagger <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-32563 6.1 SOPROBRO April 9, 2025
Customize Login Page <= 1.1 - Cross-Site Request Forgery CVE-2025-31034 4.3 Skalucy April 9, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 10, 2026
Vulns
1 Ananda Dhakal 171
2 Wordfence PRISM 68
3 Intrudify 46
4 Artus KG 36
5 Karthik Ramakrishnan 34
6 Jakub Herman 33
7 nh4tvd 32
8 Rafie Muhammad 19
9 daroo 19
10 Francisco José Ramírez Vicente 18
11 JunHee CHO 18
12 Pablo González Pérez 18
13 Iñigo Sánchez Enciso 18
14 neurotx 18
15 Erwan LR 18
16 Peter Tang 16
17 Supakiad S. (m3ez) 16
18 Naoki Kawahigashi 15
19 vuxvinh 15
20 Kuba 15

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation