WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
King Addons for Elementor <= 24.12.58 - Missing Authorization
4.3
CVE-2025-30926
Mar 27, 2025
Researcher: João Pedro Soares de Alcântara
TWB Woocommerce Reviews <= 1.7.7 - Cross-Site Request Forgery
4.3
CVE-2025-30801
Mar 27, 2025
Researcher: Nguyen Xuan Chien
Flexible Cookies <= 1.1.8 - Cross-Site Request Forgery
4.3
CVE-2025-30805
Mar 27, 2025
Researcher: Skalucy
WP Fast Total Search <= 1.79.262 - Missing Authorization
4.3
CVE-2025-30894
Mar 27, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Gift Message for WooCommerce <= 1.7.8 - Cross-Site Request Forgery
4.3
CVE-2025-30923
Mar 27, 2025
Researcher: Kévin Mosbahi (Mika)
Essential Real Estate <= 5.2.0 - Unauthenticated Local File Inclusion
9.8
CVE-2025-30849
Mar 27, 2025
Researcher: LVT-tholv2k
The Ultimate WordPress Toolkit – WP Extended <= 3.0.14 - Reflected Cross-Site Scripting
6.1
CVE-2025-30796
Mar 27, 2025
Researcher: Le Ngoc Anh
Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-30838
Mar 27, 2025
Researcher: Prissy
Clearout Email Validator <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-30789
Mar 27, 2025
Researcher: Nabil Irawan
Scheduled &amp; Automatic Order Status Controller for WooCommerce <= 3.7.1 - Open Redirect
7.2
CVE-2025-30781
Mar 27, 2025
Researcher: Le Ngoc Anh
Chartify <= 3.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-30904
Mar 27, 2025
Researcher: astra.r3verii
Just Writing Statistics <= 5.3 - Missing Authorization
4.3
CVE-2025-30803
Mar 27, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Rapyd Payment Extension for WooCommerce <= 1.2.0 - Unauthenticated PHP Object Injection
9.8
CVE-2025-30618
Mar 27, 2025
Researcher: astra.r3verii
SNORDIAN's H5PxAPIkatchu <= 0.4.14 - Missing Authorization
5.3
CVE-2025-30821
Mar 27, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
WP Travel Engine <= 6.3.5 - Unauthenticated Local File Inclusion
9.8
CVE-2025-30870
Mar 27, 2025
Researcher: LVT-tholv2k
Primer MyData for Woocommerce < 4.2.4 - Reflected Cross-Site Scripting
6.1
CVE-2025-30924
Mar 27, 2025
Researcher: João Pedro Soares de Alcântara
Quiz Cat <= 3.0.8 - Missing Authorization
4.3
CVE-2025-30877
Mar 27, 2025
Researcher: Peter Thaleikis
WishSuite <= 1.4.4 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-30820
Mar 27, 2025
Researcher: LVT-tholv2k
Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-1523
Mar 27, 2025
Researcher: Krugov Artyom
Better WishList API <= 1.1.4 - Reflected Cross-Site Scripting
6.1
CVE-2025-30798
Mar 27, 2025
Researcher: 0xd4rk5id3
Title CVE ID CVSS Researchers Date
King Addons for Elementor <= 24.12.58 - Missing Authorization CVE-2025-30926 4.3 João Pedro Soares de Alcântara March 27, 2025
TWB Woocommerce Reviews <= 1.7.7 - Cross-Site Request Forgery CVE-2025-30801 4.3 Nguyen Xuan Chien March 27, 2025
Flexible Cookies <= 1.1.8 - Cross-Site Request Forgery CVE-2025-30805 4.3 Skalucy March 27, 2025
WP Fast Total Search <= 1.79.262 - Missing Authorization CVE-2025-30894 4.3 Trương Hữu Phúc (truonghuuphuc) March 27, 2025
Gift Message for WooCommerce <= 1.7.8 - Cross-Site Request Forgery CVE-2025-30923 4.3 Kévin Mosbahi (Mika) March 27, 2025
Essential Real Estate <= 5.2.0 - Unauthenticated Local File Inclusion CVE-2025-30849 9.8 LVT-tholv2k March 27, 2025
The Ultimate WordPress Toolkit – WP Extended <= 3.0.14 - Reflected Cross-Site Scripting CVE-2025-30796 6.1 Le Ngoc Anh March 27, 2025
Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-30838 6.4 Prissy March 27, 2025
Clearout Email Validator <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-30789 4.4 Nabil Irawan March 27, 2025
Scheduled &amp; Automatic Order Status Controller for WooCommerce <= 3.7.1 - Open Redirect CVE-2025-30781 7.2 Le Ngoc Anh March 27, 2025
Chartify <= 3.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-30904 4.4 astra.r3verii March 27, 2025
Just Writing Statistics <= 5.3 - Missing Authorization CVE-2025-30803 4.3 Trương Hữu Phúc (truonghuuphuc) March 27, 2025
Rapyd Payment Extension for WooCommerce <= 1.2.0 - Unauthenticated PHP Object Injection CVE-2025-30618 9.8 astra.r3verii March 27, 2025
SNORDIAN's H5PxAPIkatchu <= 0.4.14 - Missing Authorization CVE-2025-30821 5.3 Trương Hữu Phúc (truonghuuphuc) March 27, 2025
WP Travel Engine <= 6.3.5 - Unauthenticated Local File Inclusion CVE-2025-30870 9.8 LVT-tholv2k March 27, 2025
Primer MyData for Woocommerce < 4.2.4 - Reflected Cross-Site Scripting CVE-2025-30924 6.1 João Pedro Soares de Alcântara March 27, 2025
Quiz Cat <= 3.0.8 - Missing Authorization CVE-2025-30877 4.3 Peter Thaleikis March 27, 2025
WishSuite <= 1.4.4 - Authenticated (Contributor+) Local File Inclusion CVE-2025-30820 8.8 LVT-tholv2k March 27, 2025
Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-1523 4.4 Krugov Artyom March 27, 2025
Better WishList API <= 1.1.4 - Reflected Cross-Site Scripting CVE-2025-30798 6.1 0xd4rk5id3 March 27, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 5, 2026
Vulns
1 Ananda Dhakal 75
2 Wordfence PRISM 65
3 Karthik Ramakrishnan 34
4 Jakub Herman 30
5 Artus KG 30
6 Intrudify 20
7 daroo 19
8 nh4tvd 17
9 Kuba 14
10 Erwan LR 14
11 Pablo González Pérez 14
12 Francisco José Ramírez Vicente 14
13 Dmitrii Ignatyev 14
14 Iñigo Sánchez Enciso 14
15 h0xilo 13
16 vuxvinh 12
17 Revanth Hari Narayana Matte 12
18 Charles Vosburgh 12
19 Supakiad S. (m3ez) 12
20 Pedro Pinho 12

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation