WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
6.1
CVE-2024-12077
Jan 6, 2025
Researcher: vgo0
RSVP and Event Management <= 2.7.13 - Missing Authorization
5.3
CVE-2024-12711
Jan 6, 2025
Researcher: Lucio Sá
Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting
6.1
CVE-2024-12256
Jan 6, 2025
Researcher: vgo0
Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11826
Jan 6, 2025
Researcher: theviper17y
Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting
6.1
CVE-2024-9354
Jan 6, 2025
Researcher: vgo0
Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax
8.8
CVE-2024-12202
Jan 6, 2025
Researcher: Tonn
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2024-12738
Jan 6, 2025
Researcher: Brian Mungai
Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting
6.1
CVE-2024-11369
Jan 6, 2025
Researcher: vgo0
Sina Extension for Elementor <= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ
6.4
CVE-2024-12624
Jan 6, 2025
Researcher: zer0gh0st
WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal
4.3
CVE-2024-12719
Jan 6, 2025
Researcher: Lucio Sá
SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
8.8
CVE-2024-11725
Jan 6, 2025
Researcher: 1337_Wannabe
WP Social AutoConnect <= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
6.1
CVE-2024-12279
Jan 3, 2025
Researcher: vgo0
WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-12475
Jan 3, 2025
Researcher: SOPROBRO
Turnkey bbPress by WeaverTheme <= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter
6.1
CVE-2024-12221
Jan 3, 2025
Researcher: vgo0
Taskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode
6.4
CVE-2024-11930
Jan 3, 2025
Researcher: Peter Thaleikis
Scratch & Win – Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function
5.4
CVE-2024-12545
Jan 3, 2025
Researcher: Peter Thaleikis
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
6.1
CVE-2024-11974
Jan 3, 2025
Researcher: vgo0
WP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server Parameter
6.1
CVE-2024-12047
Jan 3, 2025
Researcher: vgo0
WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution
7.3
CVE-2024-11733
Jan 3, 2025
Researcher: mikemyers
Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery
4.3
CVE-2024-12237
Jan 3, 2025
Researcher: shaman0x01
Title CVE ID CVSS Researchers Date
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' CVE-2024-12077 6.1 vgo0 January 6, 2025
RSVP and Event Management <= 2.7.13 - Missing Authorization CVE-2024-12711 5.3 Lucio Sá January 6, 2025
Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting CVE-2024-12256 6.1 vgo0 January 6, 2025
Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11826 6.4 theviper17y January 6, 2025
Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting CVE-2024-9354 6.1 vgo0 January 6, 2025
Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax CVE-2024-12202 8.8 Tonn January 6, 2025
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting CVE-2024-12738 6.1 Brian Mungai January 6, 2025
Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting CVE-2024-11369 6.1 vgo0 January 6, 2025
Sina Extension for Elementor <= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ CVE-2024-12624 6.4 zer0gh0st January 6, 2025
WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal CVE-2024-12719 4.3 Lucio Sá January 6, 2025
SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update CVE-2024-11725 8.8 1337_Wannabe January 6, 2025
WP Social AutoConnect <= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting CVE-2024-12279 6.1 vgo0 January 3, 2025
WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-12475 6.4 SOPROBRO January 3, 2025
Turnkey bbPress by WeaverTheme <= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter CVE-2024-12221 6.1 vgo0 January 3, 2025
Taskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode CVE-2024-11930 6.4 Peter Thaleikis January 3, 2025
Scratch & Win – Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function CVE-2024-12545 5.4 Peter Thaleikis January 3, 2025
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters CVE-2024-11974 6.1 vgo0 January 3, 2025
WP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server Parameter CVE-2024-12047 6.1 vgo0 January 3, 2025
WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-11733 7.3 mikemyers January 3, 2025
Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery CVE-2024-12237 4.3 shaman0x01 January 3, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Dec 14, 2024
Vulns
1 vgo0 56
2 SOPROBRO 39
3 Rafie Muhammad 33
4 Peter Thaleikis 28
5 João Pedro Soares de Alcântara 27
6 Lucio Sá 26
7 Mika 21
8 Francesco Carlucci 19
9 zaim 17
10 yudha 13
11 theviper17y 13
12 Webbernaut 12
13 Tieu Pham Trong Nhan 10
14 zakaria 9
15 Bonds 9
16 Trương Hữu Phúc (truonghuuphuc) 8
17 Colin Xu 8
18 zer0gh0st 8
19 0xd4rk5id3 7
20 stealthcopter 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation