WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Classic <= 1.5 - Cross-Site Scripting
6.1
CVE-2007-4483
Aug 12, 2007
Researcher: Eugene Dokukin
Pool <= 1.0.7 - Reflected Cross-Site Scripting
6.1
CVE-2007-4482
Aug 13, 2007
Researcher: Eugene Dokukin
Blix 0.9.1 and Blix 0.9.1 Rus - Cross-Site Scripting
6.1
CVE-2007-4481
Aug 17, 2007
Researcher: Eugene Dokukin
Sirius <= 1.0 - Cross-Site Scripting
6.1
CVE-2007-4480
Aug 17, 2007
Researcher: Eugene Dokukin
WordPress MU <= 1.0 - Cross-Site Scripting
6.1
CVE-2007-4544
Aug 22, 2007
Researcher: Eugene Dokukin
WordPress Core < 2.3.2 - SQL Injection
9.8
CVE-2007-6318
Sep 8, 2007
Researchers:
WordPress Core < 2.3.3 & WordPress MU < 1.3.2 - Remote Code Execution
8.8
CVE-2008-5695
Sep 8, 2007
Researchers:
WordPress Core < 2.3.3 - Improper Authorization Checks
6.5
CVE-2008-0664
Sep 8, 2007
Researchers:
WordPress Core < 2.2.3 - Restriction Bypass
5.3
CVE-2008-2146
Sep 8, 2007
Researchers:
WordPress Core < 2.2.3 & WordPress MU < 1.2.5a - SQL Injection
9.8
CVE-2007-4894
Sep 8, 2007
Researchers:
WordPress Core < 2.0.4 - Cross-Site Scripting
6.4
CVE-2007-5106
Sep 21, 2007
Researcher: Adrian Pastor
FeedBurner FeedSmith <= 2.2 - Cross-Site Request Forgery
8.8
CVE-2007-5229
Oct 4, 2007
Researcher: David Kierznowski
WordPress Core <= 2.3 - Cross-Site Scripting
6.4
CVE-2007-5710
Oct 26, 2007
Researcher: Janek Vind
BackUpWordPress <= 0.4.2b - Remote File Inclusion
9.8
CVE-2007-5800
Nov 1, 2007
Researcher: S.W.A.T.
Peter’s Random Anti-Spam Image <= 1.0.6 - Cross-Site Scripting
6.1
CVE-2007-6677
Nov 12, 2007
Researcher: Eugene Dokukin
Math Comment Spam Protection <= 2.1 - Cross-Site Request Forgery
8.8
CVE-2008-0205
Nov 23, 2007
Researcher: Eugene Dokukin
Captcha! <= 2.5d - Cross-Site Scripting
7.1
CVE-2008-0206
Nov 26, 2007
Researcher: Eugene Dokukin
Cryptographp <= 1.2 - Cross-Site Scripting
7.2
CVE-2008-0203
Nov 28, 2007
Researchers:
PictPress <= 0.91 - Directory Traversal
7.5
CVE-2007-6369
Dec 5, 2007
Researcher: GolD_M
WordPress Core < 2.5 - Full Path Disclosure
5.3
CVE-2008-0191
Dec 16, 2007
Researcher: Eugene Dokukin
Title CVE ID CVSS Researchers Date
Classic <= 1.5 - Cross-Site Scripting CVE-2007-4483 6.1 Eugene Dokukin August 12, 2007
Pool <= 1.0.7 - Reflected Cross-Site Scripting CVE-2007-4482 6.1 Eugene Dokukin August 13, 2007
Blix 0.9.1 and Blix 0.9.1 Rus - Cross-Site Scripting CVE-2007-4481 6.1 Eugene Dokukin August 17, 2007
Sirius <= 1.0 - Cross-Site Scripting CVE-2007-4480 6.1 Eugene Dokukin August 17, 2007
WordPress MU <= 1.0 - Cross-Site Scripting CVE-2007-4544 6.1 Eugene Dokukin August 22, 2007
WordPress Core < 2.3.2 - SQL Injection CVE-2007-6318 9.8 September 8, 2007
WordPress Core < 2.3.3 & WordPress MU < 1.3.2 - Remote Code Execution CVE-2008-5695 8.8 September 8, 2007
WordPress Core < 2.3.3 - Improper Authorization Checks CVE-2008-0664 6.5 September 8, 2007
WordPress Core < 2.2.3 - Restriction Bypass CVE-2008-2146 5.3 September 8, 2007
WordPress Core < 2.2.3 & WordPress MU < 1.2.5a - SQL Injection CVE-2007-4894 9.8 September 8, 2007
WordPress Core < 2.0.4 - Cross-Site Scripting CVE-2007-5106 6.4 Adrian Pastor September 21, 2007
FeedBurner FeedSmith <= 2.2 - Cross-Site Request Forgery CVE-2007-5229 8.8 David Kierznowski October 4, 2007
WordPress Core <= 2.3 - Cross-Site Scripting CVE-2007-5710 6.4 Janek Vind October 26, 2007
BackUpWordPress <= 0.4.2b - Remote File Inclusion CVE-2007-5800 9.8 S.W.A.T. November 1, 2007
Peter’s Random Anti-Spam Image <= 1.0.6 - Cross-Site Scripting CVE-2007-6677 6.1 Eugene Dokukin November 12, 2007
Math Comment Spam Protection <= 2.1 - Cross-Site Request Forgery CVE-2008-0205 8.8 Eugene Dokukin November 23, 2007
Captcha! <= 2.5d - Cross-Site Scripting CVE-2008-0206 7.1 Eugene Dokukin November 26, 2007
Cryptographp <= 1.2 - Cross-Site Scripting CVE-2008-0203 7.2 November 28, 2007
PictPress <= 0.91 - Directory Traversal CVE-2007-6369 7.5 GolD_M December 5, 2007
WordPress Core < 2.5 - Full Path Disclosure CVE-2008-0191 5.3 Eugene Dokukin December 16, 2007
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Apr 21, 2024
Vulns
1 stealthcopter 62
2 Dhabaleshwar Das 50
3 Ngô Thiên An (ancorn_) 37
4 wesley (wcraft) 36
5 Rafie Muhammad 35
6 Joshua Chan 34
7 Bob Matyas 28
8 Krzysztof Zając 27
9 Francesco Carlucci 24
10 Lucio Sá 22
11 Steven Julian 22
12 Benedictus Jovan (aillesiM) 18
13 Webbernaut 18
14 Abdi Pranata 17
15 Khalid 15
16 Dave Jong 15
17 Majed Refaea 15
18 Peng Zhou 13
19 Dmitrii Ignatyev 12
20 João G. Barbosa (4rCanJ0x!) 12

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation