WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
1 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-3870
Apr 24, 2025
Researcher: johska
Custom Admin-Bar Favorites <= 0.1 - Reflected Cross-Site Scripting
6.1
CVE-2025-3868
Apr 24, 2025
Researcher: johska
Ajax Comment Form CST <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-3867
Apr 24, 2025
Researcher: johska
Add Google +1 (Plus one) social share Button <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-3866
Apr 24, 2025
Researcher: johska
Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
4.9
CVE-2025-2580
Apr 24, 2025
Researcher: Avraham Shemesh
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter
6.5
CVE-2025-3775
Apr 24, 2025
Researcher: mikemyers
Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter
6.4
CVE-2025-3749
Apr 24, 2025
Researcher: Peter Thaleikis
eForm <= 4.18.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-1294
Apr 24, 2025
Researcher: shaman0x01
Mini twitter feed <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-46496
Apr 24, 2025
Researcher: johska
Availability Calendar <= 0.2.4 - Cross-Site Request Forgery
4.3
CVE-2025-46528
Apr 24, 2025
Researcher: johska
JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins
8.1
CVE-2024-11917
Apr 24, 2025
Researcher: Foxyyy
PayPal Express Checkout <= 2.1.2 - Cross-Site Request Forgery
4.3
CVE-2025-46499
Apr 24, 2025
Researcher: johska
Fable Extra <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-46447
Apr 24, 2025
Researcher: timomangcut
Dropdown Content <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-46478
Apr 24, 2025
Researcher: Muhammad Yudha - DJ
RAphicon <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-46467
Apr 24, 2025
Researcher: johska
BBCode Deluxe <= 2020.08.01.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-46479
Apr 24, 2025
Researcher: johska
Confirm User Registration <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
5.5
CVE-2025-46459
Apr 24, 2025
Researcher: Nabil Irawan
Send From <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
5.5
CVE-2025-46469
Apr 24, 2025
Researcher: Nabil Irawan
LSD Custom taxonomy and category meta <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2025-46502
Apr 24, 2025
Researcher: johska
Image Style Hover <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-46534
Apr 24, 2025
Researcher: johska
Title CVE ID CVSS Researchers Date
1 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-3870 6.1 johska April 24, 2025
Custom Admin-Bar Favorites <= 0.1 - Reflected Cross-Site Scripting CVE-2025-3868 6.1 johska April 24, 2025
Ajax Comment Form CST <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-3867 6.1 johska April 24, 2025
Add Google +1 (Plus one) social share Button <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-3866 6.1 johska April 24, 2025
Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2025-2580 4.9 Avraham Shemesh April 24, 2025
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter CVE-2025-3775 6.5 mikemyers April 24, 2025
Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter CVE-2025-3749 6.4 Peter Thaleikis April 24, 2025
eForm <= 4.18.0 - Unauthenticated Stored Cross-Site Scripting CVE-2025-1294 7.2 shaman0x01 April 24, 2025
Mini twitter feed <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-46496 6.4 johska April 24, 2025
Availability Calendar <= 0.2.4 - Cross-Site Request Forgery CVE-2025-46528 4.3 johska April 24, 2025
JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins CVE-2024-11917 8.1 Foxyyy April 24, 2025
PayPal Express Checkout <= 2.1.2 - Cross-Site Request Forgery CVE-2025-46499 4.3 johska April 24, 2025
Fable Extra <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-46447 6.4 timomangcut April 24, 2025
Dropdown Content <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-46478 6.4 Muhammad Yudha - DJ April 24, 2025
RAphicon <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-46467 6.4 johska April 24, 2025
BBCode Deluxe <= 2020.08.01.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-46479 6.4 johska April 24, 2025
Confirm User Registration <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-46459 5.5 Nabil Irawan April 24, 2025
Send From <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-46469 5.5 Nabil Irawan April 24, 2025
LSD Custom taxonomy and category meta <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-46502 6.1 johska April 24, 2025
Image Style Hover <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-46534 6.4 johska April 24, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 15, 2026
Vulns
1 Ananda Dhakal 193
2 Wordfence PRISM 70
3 Intrudify 48
4 João Pedro S Alcântara 42
5 nh4tvd 39
6 johska 34
7 Jakub Herman 31
8 Karthik Ramakrishnan 30
9 Artus KG 28
10 Naoki Kawahigashi 28
11 Enrico Marcolini 26
12 Bonds 26
13 Rafie Muhammad 25
14 Peter Tang 25
15 neurotx 22
16 Erwan LR 21
17 daroo 21
18 Francisco José Ramírez Vicente 20
19 Iñigo Sánchez Enciso 20
20 Tran Nguyen Bao Khanh 20

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation