WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WP Time Slots Booking Form <= 1.1.81 - Authenticated (Admin+) Stored Cross Site Scripting
3.8
CVE-2023-23971
Jan 20, 2023
Researcher: Rio Darmawan
Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification
3.8
CVE-2022-4031
Nov 29, 2022
Researchers: Luca Greeb, Andreas Krüger
Enable SVG, WebP & ICO Upload <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
3.8
CVE-2022-36343
Aug 1, 2022
Researcher: Kim Jong Min
Image Gallery – Grid Gallery <= 1.1.1 - Stored Cross-Site Scripting
3.8
CVE-2022-1327
Jun 3, 2022
Researcher: Fayçal Chena
Countdown & Clock <= 2.3.2 - Pro Features Lock Bypass
3.8
CVE-2022-29423
Apr 28, 2022
Researcher: RE-ALTER
WP YouTube Lyte <= 1.7.15 - Authenticated (Admin+) Cross-Site Scripting
3.8
CVE-2021-24419
May 3, 2021
Researcher: RE-ALTER
MonsterInsights - Google Analytics Dashboard for WordPress <= 5.4.4 - Authenticated Stored Cross-Site Scripting
3.8
CVE ID Unknown
Aug 10, 2015
Researcher: Mallory Adams
WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL
3.8
CVE-2014-5240
Aug 6, 2014
Researchers:
Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion
3.8
CVE ID Unknown
Jan 3, 2013
Researchers:
WordPress Core < 3.4.2 - Missing Authorization Checks
3.8
CVE-2012-4422
Sep 6, 2012
Researchers:
Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
4.0
CVE-2024-43986
Aug 29, 2024
Researcher: Sharanabasappa
WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting
4.0
CVE-2024-7388
Aug 12, 2024
Researcher: Nguyễn Trung Kiên
YITH Custom Login <= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
4.0
CVE-2024-35732
Jun 6, 2024
Researcher: STEALIEN
Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting
4.0
CVE-2023-1159
Jun 1, 2023
Researcher: Vinay Kumar
WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery
4.0
CVE-2022-3590
Sep 6, 2022
Researchers: Simon Scannell, Thomas Chauchefoin
Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal
4.1
CVE-2023-6120
Dec 8, 2023
Researcher: Marco Wotschka
GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler
4.1
CVE-2022-40312
Mar 8, 2023
Researcher: Rafie Muhammad
WP Time Slots Booking Form <= 1.1.82 - Improper Authorization Checks
4.1
CVE-2023-23895
Jan 20, 2023
Researcher: yuyudhn
GeoDirectory <= 2.2.19 - CSV Injection
4.1
CVE ID Unknown
Dec 20, 2022
Researchers:
Wholesale Market for WooCommerce < 2.0.0 - Authenticated (Administrator+) Arbitrary Log File Download
4.1
CVE-2022-4109
Dec 12, 2022
Researcher: WPScanTeam
Title CVE ID CVSS Researchers Date
WP Time Slots Booking Form <= 1.1.81 - Authenticated (Admin+) Stored Cross Site Scripting CVE-2023-23971 3.8 Rio Darmawan January 20, 2023
Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification CVE-2022-4031 3.8 Luca Greeb, Andreas Krüger November 29, 2022
Enable SVG, WebP & ICO Upload <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2022-36343 3.8 Kim Jong Min August 1, 2022
Image Gallery – Grid Gallery <= 1.1.1 - Stored Cross-Site Scripting CVE-2022-1327 3.8 Fayçal Chena June 3, 2022
Countdown & Clock <= 2.3.2 - Pro Features Lock Bypass CVE-2022-29423 3.8 RE-ALTER April 28, 2022
WP YouTube Lyte <= 1.7.15 - Authenticated (Admin+) Cross-Site Scripting CVE-2021-24419 3.8 RE-ALTER May 3, 2021
MonsterInsights - Google Analytics Dashboard for WordPress <= 5.4.4 - Authenticated Stored Cross-Site Scripting 3.8 Mallory Adams August 10, 2015
WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL CVE-2014-5240 3.8 August 6, 2014
Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion 3.8 January 3, 2013
WordPress Core < 3.4.2 - Missing Authorization Checks CVE-2012-4422 3.8 September 6, 2012
Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-43986 4.0 Sharanabasappa August 29, 2024
WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-7388 4.0 Nguyễn Trung Kiên August 12, 2024
YITH Custom Login <= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-35732 4.0 STEALIEN June 6, 2024
Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-1159 4.0 Vinay Kumar June 1, 2023
WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery CVE-2022-3590 4.0 Simon Scannell, Thomas Chauchefoin September 6, 2022
Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal CVE-2023-6120 4.1 Marco Wotschka December 8, 2023
GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler CVE-2022-40312 4.1 Rafie Muhammad March 8, 2023
WP Time Slots Booking Form <= 1.1.82 - Improper Authorization Checks CVE-2023-23895 4.1 yuyudhn January 20, 2023
GeoDirectory <= 2.2.19 - CSV Injection 4.1 December 20, 2022
Wholesale Market for WooCommerce < 2.0.0 - Authenticated (Administrator+) Arbitrary Log File Download CVE-2022-4109 4.1 WPScanTeam December 12, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 20, 2024
Vulns
1 stealthcopter 25
2 wesley (wcraft) 21
3 Francesco Carlucci 20
4 Lucio Sá 19
5 Daniel Ruf 16
6 vgo0 15
7 Rafie Muhammad 12
8 Dave Jong 11
9 Ananda Dhakal 9
10 Marco Wotschka 8
11 Peter Thaleikis 6
12 Muhammad Daffa 6
13 Krzysztof Zając 6
14 João Pedro Soares de Alcântara 5
15 Webbernaut 5
16 Bob Matyas 5
17 Le Ngoc Anh 5
18 Fariq Fadillah Gusti Insani (fariqfgi) 5
19 rezaduty 4
20 LVT-tholv2k 4

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation