WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Easy Forms for Mailchimp <= 6.8.8 - Reflected Cross-Site Scripting via 'sql_error'
6.1
CVE-2023-23900
May 17, 2023
Researcher: Rafie Muhammad
WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db
4.3
CVE-2023-2285
May 17, 2023
Researcher: Marco Wotschka
Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting
7.4
CVE-2023-2757
May 17, 2023
Researcher: István Márton
Baidu Tongji generator <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.3
CVE-2023-31233
May 18, 2023
Researcher: LEE SE HYOUNG
WooCommerce Predictive Search <= 5.8.0 - Cross-Site Request Forgery via multiple AJAX actions
5.3
CVE-2023-32963
May 18, 2023
Researcher: Mika
WeSecur Security <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-24390
May 18, 2023
Researcher: Prasanna V Balaji
nuajik CDN <= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-33210
May 18, 2023
Researcher: Pavitra Tiwari
Better Notifications for WP <= 1.9.2 - Cross-Site Request Forgery via handle_actions
4.3
CVE-2023-32964
May 18, 2023
Researcher: Nguyen Xuan Chien
WooCommerce Predictive Search <= 5.8.0 - Missing Authorization via multiple AJAX actions
5.3
CVE-2023-32963
May 18, 2023
Researcher: Mika
Performance Lab <= 2.2.0 - Cross-Site Request Forgery via dismiss-wp-pointer
4.3
CVE-2022-47174
May 18, 2023
Researcher: Muhammad Daffa
UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage
6.1
CVE-2023-32960
May 18, 2023
Researcher: Rafie Muhammad
Jazz Popups <= 1.8.7 - Cross-Site Request Forgery
4.3
CVE-2023-32966
May 18, 2023
Researcher: thiennv
WP htaccess Control <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-25462
May 18, 2023
Researcher: Rio Darmawan
Stop Referrer Spam <= 1.3.0 - Cross-Site Request Forgery via processParameters
5.4
CVE-2023-33207
May 18, 2023
Researcher: Mika
Scripts n Styles <= 3.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-31236
May 18, 2023
Researcher: konagash
Cookie Monster <= 1.51 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-33208
May 18, 2023
Researcher: Prasanna V Balaji
BP Social Connect <= 1.5 - Authentication Bypass
9.8
CVE-2023-2704
May 18, 2023
Researcher: István Márton
SEO Change Monitor <= 1.2 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2023-33209
May 18, 2023
Researcher: Nithissh S
Jazz Popups <= 1.8.7 - Reflected Cross-Site Scripting via 'wpjazzpopup_switchonoff'
6.1
CVE-2023-32965
May 18, 2023
Researcher: thiennv
WishSuite <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-32962
May 18, 2023
Researcher: Emili Castells
Title CVE ID CVSS Researchers Date
Easy Forms for Mailchimp <= 6.8.8 - Reflected Cross-Site Scripting via 'sql_error' CVE-2023-23900 6.1 Rafie Muhammad May 17, 2023
WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db CVE-2023-2285 4.3 Marco Wotschka May 17, 2023
Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2023-2757 7.4 István Márton May 17, 2023
Baidu Tongji generator <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-31233 3.3 LEE SE HYOUNG May 18, 2023
WooCommerce Predictive Search <= 5.8.0 - Cross-Site Request Forgery via multiple AJAX actions CVE-2023-32963 5.3 Mika May 18, 2023
WeSecur Security <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-24390 4.4 Prasanna V Balaji May 18, 2023
nuajik CDN <= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-33210 4.4 Pavitra Tiwari May 18, 2023
Better Notifications for WP <= 1.9.2 - Cross-Site Request Forgery via handle_actions CVE-2023-32964 4.3 Nguyen Xuan Chien May 18, 2023
WooCommerce Predictive Search <= 5.8.0 - Missing Authorization via multiple AJAX actions CVE-2023-32963 5.3 Mika May 18, 2023
Performance Lab <= 2.2.0 - Cross-Site Request Forgery via dismiss-wp-pointer CVE-2022-47174 4.3 Muhammad Daffa May 18, 2023
UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage CVE-2023-32960 6.1 Rafie Muhammad May 18, 2023
Jazz Popups <= 1.8.7 - Cross-Site Request Forgery CVE-2023-32966 4.3 thiennv May 18, 2023
WP htaccess Control <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-25462 4.4 Rio Darmawan May 18, 2023
Stop Referrer Spam <= 1.3.0 - Cross-Site Request Forgery via processParameters CVE-2023-33207 5.4 Mika May 18, 2023
Scripts n Styles <= 3.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-31236 4.4 konagash May 18, 2023
Cookie Monster <= 1.51 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-33208 4.4 Prasanna V Balaji May 18, 2023
BP Social Connect <= 1.5 - Authentication Bypass CVE-2023-2704 9.8 István Márton May 18, 2023
SEO Change Monitor <= 1.2 - Authenticated (Subscriber+) SQL Injection CVE-2023-33209 8.8 Nithissh S May 18, 2023
Jazz Popups <= 1.8.7 - Reflected Cross-Site Scripting via 'wpjazzpopup_switchonoff' CVE-2023-32965 6.1 thiennv May 18, 2023
WishSuite <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-32962 4.4 Emili Castells May 18, 2023
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Apr 18, 2024
Vulns
1 stealthcopter 60
2 Dhabaleshwar Das 46
3 Ngô Thiên An (ancorn_) 37
4 Rafie Muhammad 35
5 wesley (wcraft) 33
6 Joshua Chan 32
7 Krzysztof Zając 29
8 Bob Matyas 26
9 Francesco Carlucci 24
10 Steven Julian 22
11 Lucio Sá 22
12 Benedictus Jovan (aillesiM) 18
13 Webbernaut 18
14 Abdi Pranata 16
15 Khalid 16
16 Majed Refaea 16
17 Dave Jong 15
18 Peng Zhou 12
19 Dmitrii Ignatyev 11
20 LVT-tholv2k 11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation