WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change
4.3
CVE-2025-0935
Feb 14, 2025
Researcher: Brian Sans-Souci (liardom)
Email Keep <= 1.1 - Cross-Site Request Forgery to Email Deletion
4.3
CVE-2024-13826
Feb 14, 2025
Researcher: Bob Matyas
Distance Based Shipping Calculator <= 2.0.22 - Missing Authorization
4.3
CVE-2025-26765
Feb 14, 2025
Researcher: Kévin Mosbahi (Mika)
Analytify <= 5.5.0 - Missing Authorization
4.3
CVE-2025-26773
Feb 14, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
RTMKit <= 1.6.7 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2025-64283
Feb 14, 2025
Researcher: Chazz Wolcott
DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update
4.3
CVE-2024-10581
Feb 14, 2025
Researcher: incognito
Team – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update
4.3
CVE-2024-13439
Feb 14, 2025
Researcher: abrahack
Vitepos – Point of sale (POS) <= 3.1.3 - Missing Authorization
4.3
CVE-2025-26750
Feb 14, 2025
Researcher: Phat RiO
ClickWhale <= 2.4.3 - Cross-Site Request Forgery
4.3
CVE-2025-26963
Feb 13, 2025
Researcher: Tran Nguyen Bao Khanh
Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion
4.3
CVE-2024-13639
Feb 12, 2025
Researcher: theviper17y
Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion
4.3
CVE-2024-13229
Feb 12, 2025
Researcher: Webbernaut
DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure
4.3
CVE-2025-0661
Feb 12, 2025
Researcher: Webbernaut
Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2024-13437
Feb 11, 2025
Researcher: SOPROBRO
Easy Booked – Appointment Booking and Scheduling Management System for WordPress <= 2.4.5 - Cross-Site Request Forgery
4.3
CVE-2025-22634
Feb 11, 2025
Researcher: I8BL
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2024-13601
Feb 11, 2025
Researcher: Tim Coen
aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
4.3
CVE-2024-13541
Feb 11, 2025
Researcher: Peter Thaleikis
WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure
4.3
CVE-2024-13374
Feb 11, 2025
Researcher: Nguyễn Trung Kiên
Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion
4.3
CVE-2025-0808
Feb 11, 2025
Researcher: Dhabaleshwar Das
WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
4.3
CVE-2024-12164
Feb 11, 2025
Researcher: Kévin Mosbahi (Mika)
WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion
4.3
CVE-2024-9661
Feb 7, 2025
Researcher: Francesco Carlucci
Title CVE ID CVSS Researchers Date
Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change CVE-2025-0935 4.3 Brian Sans-Souci (liardom) February 14, 2025
Email Keep <= 1.1 - Cross-Site Request Forgery to Email Deletion CVE-2024-13826 4.3 Bob Matyas February 14, 2025
Distance Based Shipping Calculator <= 2.0.22 - Missing Authorization CVE-2025-26765 4.3 Kévin Mosbahi (Mika) February 14, 2025
Analytify <= 5.5.0 - Missing Authorization CVE-2025-26773 4.3 Trương Hữu Phúc (truonghuuphuc) February 14, 2025
RTMKit <= 1.6.7 - Authenticated (Contributor+) Insecure Direct Object Reference CVE-2025-64283 4.3 Chazz Wolcott February 14, 2025
DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update CVE-2024-10581 4.3 incognito February 14, 2025
Team – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update CVE-2024-13439 4.3 abrahack February 14, 2025
Vitepos – Point of sale (POS) <= 3.1.3 - Missing Authorization CVE-2025-26750 4.3 Phat RiO February 14, 2025
ClickWhale <= 2.4.3 - Cross-Site Request Forgery CVE-2025-26963 4.3 Tran Nguyen Bao Khanh February 13, 2025
Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion CVE-2024-13639 4.3 theviper17y February 12, 2025
Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion CVE-2024-13229 4.3 Webbernaut February 12, 2025
DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure CVE-2025-0661 4.3 Webbernaut February 12, 2025
Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update CVE-2024-13437 4.3 SOPROBRO February 11, 2025
Easy Booked – Appointment Booking and Scheduling Management System for WordPress <= 2.4.5 - Cross-Site Request Forgery CVE-2025-22634 4.3 I8BL February 11, 2025
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2024-13601 4.3 Tim Coen February 11, 2025
aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion CVE-2024-13541 4.3 Peter Thaleikis February 11, 2025
WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure CVE-2024-13374 4.3 Nguyễn Trung Kiên February 11, 2025
Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion CVE-2025-0808 4.3 Dhabaleshwar Das February 11, 2025
WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset CVE-2024-12164 4.3 Kévin Mosbahi (Mika) February 11, 2025
WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion CVE-2024-9661 4.3 Francesco Carlucci February 7, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 9, 2026
Vulns
1 Ananda Dhakal 148
2 Wordfence PRISM 42
3 Intrudify 41
4 Artus KG 34
5 Karthik Ramakrishnan 34
6 Jakub Herman 31
7 nh4tvd 24
8 daroo 19
9 Iñigo Sánchez Enciso 18
10 Francisco José Ramírez Vicente 18
11 Pablo González Pérez 18
12 JunHee CHO 16
13 Erwan LR 15
14 Usama Arshad 15
15 Pedro Pinho 14
16 Kuba 14
17 Naoki Kawahigashi 14
18 vuxvinh 13
19 Dmitrii Ignatyev 13
20 Charles Vosburgh 13

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation