WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
9.8
CVE-2024-11635
Jan 7, 2025
Researcher: abrahack
Piotnet Addons For Elementor <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Heading Widget
6.4
CVE-2024-9673
Jan 7, 2025
Researcher: Webbernaut
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
9.8
CVE-2024-11613
Jan 7, 2025
Researcher: abrahack
Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-12851
Jan 7, 2025
Researcher: zer0gh0st
The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution
8.8
CVE-2024-11816
Jan 7, 2025
Researchers: stealthcopter, theviper17y
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-12045
Jan 7, 2025
Researcher: zer0gh0st
Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-12205
Jan 7, 2025
Researcher: Webbernaut
InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
5.3
CVE-2024-10585
Jan 7, 2025
Researcher: villu164
SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure
5.3
CVE-2024-12713
Jan 7, 2025
Researcher: Lucio Sá
Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-12112
Jan 7, 2025
Researcher: Noah Stead (TurtleBurg)
The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
7.4
CVE-2024-11916
Jan 7, 2025
Researcher: Lucio Sá
WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates
8.8
CVE-2024-11271
Jan 7, 2025
Researcher: Lucio Sá
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-11830
Jan 7, 2025
Researcher: Nguyen Vuong Quoc
Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data
7.5
CVE-2024-11939
Jan 7, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion
4.3
CVE-2024-12855
Jan 7, 2025
Researcher: Lucio Sá
Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-12852
Jan 7, 2025
Researcher: zer0gh0st
Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids
6.1
CVE-2024-12337
Jan 7, 2025
Researcher: vgo0
MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
6.4
CVE-2024-12328
Jan 7, 2025
Researcher: Ryan Zegar
WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation
8.8
CVE-2024-11270
Jan 7, 2025
Researcher: Lucio Sá
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication
4.3
CVE-2024-12584
Jan 7, 2025
Researcher: Webbernaut
Title CVE ID CVSS Researchers Date
WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution CVE-2024-11635 9.8 abrahack January 7, 2025
Piotnet Addons For Elementor <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Heading Widget CVE-2024-9673 6.4 Webbernaut January 7, 2025
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion CVE-2024-11613 9.8 abrahack January 7, 2025
Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-12851 6.4 zer0gh0st January 7, 2025
The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution CVE-2024-11816 8.8 stealthcopter, theviper17y January 7, 2025
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-12045 4.4 zer0gh0st January 7, 2025
Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-12205 6.4 Webbernaut January 7, 2025
InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading CVE-2024-10585 5.3 villu164 January 7, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure CVE-2024-12713 5.3 Lucio Sá January 7, 2025
Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-12112 6.4 Noah Stead (TurtleBurg) January 7, 2025
The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-11916 7.4 Lucio Sá January 7, 2025
WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates CVE-2024-11271 8.8 Lucio Sá January 7, 2025
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11830 6.4 Nguyen Vuong Quoc January 7, 2025
Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data CVE-2024-11939 7.5 Trương Hữu Phúc (truonghuuphuc) January 7, 2025
AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion CVE-2024-12855 4.3 Lucio Sá January 7, 2025
Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-12852 6.4 zer0gh0st January 7, 2025
Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids CVE-2024-12337 6.1 vgo0 January 7, 2025
MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2024-12328 6.4 Ryan Zegar January 7, 2025
WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation CVE-2024-11270 8.8 Lucio Sá January 7, 2025
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication CVE-2024-12584 4.3 Webbernaut January 7, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Dec 14, 2024
Vulns
1 vgo0 56
2 SOPROBRO 39
3 Rafie Muhammad 33
4 Peter Thaleikis 28
5 João Pedro Soares de Alcântara 27
6 Lucio Sá 26
7 Mika 21
8 Francesco Carlucci 19
9 zaim 17
10 yudha 13
11 theviper17y 13
12 Webbernaut 12
13 Tieu Pham Trong Nhan 10
14 zakaria 9
15 Bonds 9
16 Trương Hữu Phúc (truonghuuphuc) 8
17 Colin Xu 8
18 zer0gh0st 8
19 0xd4rk5id3 7
20 stealthcopter 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation