WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion
7.2
CVE-2024-11010
Dec 6, 2024
Researcher: TANG Cheuk Hei (siunam)
افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-10046
Dec 6, 2024
Researcher: Webbernaut
Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation
4.3
CVE-2024-12026
Dec 6, 2024
Researcher: Tieu Pham Trong Nhan
Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-12165
Dec 6, 2024
Researcher: Colin Xu
Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-11329
Dec 6, 2024
Researcher: vgo0
Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page'
6.1
CVE-2024-12166
Dec 6, 2024
Researcher: Colin Xu
Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce
6.1
CVE-2024-12167
Dec 6, 2024
Researcher: vgo0
Zooom <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11451
Dec 6, 2024
Researcher: zakaria
SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
4.3
CVE-2024-11353
Dec 6, 2024
Researcher: Mika
If Menu <= 0.19.1 - Missing Authorization to License Key Update
5.3
CVE-2024-7894
Dec 6, 2024
Researcher: Marco Wotschka
Library Management System <= 3.0.0 - Authenticated (Admin+) SQL Injection
6.8
CVE-2024-8679
Dec 6, 2024
Researcher: Eduardo Bido
Poll Maker <= 5.5.4 - Cross-Site Request Forgery to Poll Duplication
4.3
CVE-2024-12115
Dec 6, 2024
Researcher: Noah Stead (TurtleBurg)
Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting
6.1
CVE-2024-11436
Dec 6, 2024
Researcher: Colin Xu
코드엠샵 소셜톡 <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11904
Dec 6, 2024
Researcher: Peter Thaleikis
CardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-12257
Dec 6, 2024
Researcher: Colin Xu
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.2.2 - Reflected Cross-Site Scripting via add_query_arg Parameter
6.1
CVE-2024-11943
Dec 6, 2024
Researcher: Peter Thaleikis
Verowa Connect <= 3.0.1 - Unauthenticated SQL Injection
7.5
CVE-2024-11460
Dec 5, 2024
Researcher: Colin Xu
Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode
6.3
CVE-2024-10909
Dec 5, 2024
Researcher: Arkadiusz Hydzik
TwentyTwenty <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11352
Dec 5, 2024
Researcher: yudha
Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions
4.3
CVE-2024-12027
Dec 5, 2024
Researcher: Tieu Pham Trong Nhan
Title CVE ID CVSS Researchers Date
FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion CVE-2024-11010 7.2 TANG Cheuk Hei (siunam) December 6, 2024
افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting CVE-2024-10046 6.1 Webbernaut December 6, 2024
Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation CVE-2024-12026 4.3 Tieu Pham Trong Nhan December 6, 2024
Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting CVE-2024-12165 6.1 Colin Xu December 6, 2024
Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting CVE-2024-11329 6.1 vgo0 December 6, 2024
Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page' CVE-2024-12166 6.1 Colin Xu December 6, 2024
Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce CVE-2024-12167 6.1 vgo0 December 6, 2024
Zooom <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11451 6.4 zakaria December 6, 2024
SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion CVE-2024-11353 4.3 Mika December 6, 2024
If Menu <= 0.19.1 - Missing Authorization to License Key Update CVE-2024-7894 5.3 Marco Wotschka December 6, 2024
Library Management System <= 3.0.0 - Authenticated (Admin+) SQL Injection CVE-2024-8679 6.8 Eduardo Bido December 6, 2024
Poll Maker <= 5.5.4 - Cross-Site Request Forgery to Poll Duplication CVE-2024-12115 4.3 Noah Stead (TurtleBurg) December 6, 2024
Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting CVE-2024-11436 6.1 Colin Xu December 6, 2024
코드엠샵 소셜톡 <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11904 6.4 Peter Thaleikis December 6, 2024
CardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting CVE-2024-12257 6.1 Colin Xu December 6, 2024
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.2.2 - Reflected Cross-Site Scripting via add_query_arg Parameter CVE-2024-11943 6.1 Peter Thaleikis December 6, 2024
Verowa Connect <= 3.0.1 - Unauthenticated SQL Injection CVE-2024-11460 7.5 Colin Xu December 5, 2024
Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode CVE-2024-10909 6.3 Arkadiusz Hydzik December 5, 2024
TwentyTwenty <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11352 6.4 yudha December 5, 2024
Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions CVE-2024-12027 4.3 Tieu Pham Trong Nhan December 5, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Nov 10, 2024
Vulns
1 SOPROBRO 77
2 Peter Thaleikis 66
3 vgo0 60
4 Francesco Carlucci 52
5 stealthcopter 30
6 João Pedro Soares de Alcântara 26
7 Mika 24
8 Arkadiusz Hydzik 15
9 Tieu Pham Trong Nhan 14
10 Colin Xu 12
11 zer0gh0st 11
12 István Márton 11
13 LVT-tholv2k 11
14 Tonn 10
15 Le Ngoc Anh 10
16 zakaria 10
17 theviper17y 9
18 mikemyers 9
19 Gab 7
20 Trương Hữu Phúc (truonghuuphuc) 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation