WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Multiple Plugins by tychesoftwares <= (Various Versions) - Missing Authorization to Notice Dismissal
4.3
CVE-2024-4233
Apr 26, 2024
Researcher: Dhabaleshwar Das
ColibriWP Theme framework <= (Various Versions) - Missing Authorization
4.3
CVE-2024-33686
Apr 26, 2024
Researcher: Dhabaleshwar Das
Meks Smart Social Widget <= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-33693
Apr 26, 2024
Researcher: Joshua Chan
WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-1572
Apr 26, 2024
Researcher: Richard Telleng (stueotue)
WP GDPR Compliance <= 2.0.23 - Cross-Site Request Forgery
4.3
CVE-2024-33682
Apr 26, 2024
Researcher: Mika
Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner
6.4
CVE-2024-3819
Apr 26, 2024
Researcher: wesley (wcraft)
Knowledge Base documentation & wiki plugin – BasePress <= 2.16.1 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2024-33590
Apr 25, 2024
Researcher: beluga
XStore Core <= 5.3.5 - Missing Authorization
6.3
CVE-2024-33555
Apr 25, 2024
Researcher: Rafie Muhammad
XStore Core <= 5.3.5 - Authenticated (Subscriber+) Limited Arbitrary File Upload
9.9
CVE-2024-33556
Apr 25, 2024
Researcher: Rafie Muhammad
XStore <= 9.3.5 - Missing Authorization
4.3
CVE-2024-33563
Apr 25, 2024
Researcher: Rafie Muhammad
Element Pack Pro <= 7.7.4 - Authenticated (Contributor+) Arbitrary File Read and PHAR Deserialization
9.9
CVE-2024-33568
Apr 25, 2024
Researcher: Rafie Muhammad
Radio Player <= 2.0.73 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2024-33592
Apr 25, 2024
Researcher: Steven Julian
Piotnet Addons For Elementor Pro <= 7.1.17 - Reflected Cross-Site Scripting
6.1
CVE-2024-33633
Apr 25, 2024
Researcher: Dave Jong
Crelly Slider <= 1.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
5.4
CVE-2024-33542
Apr 25, 2024
Researcher: Steven Julian
Assistant – Every Day Productivity Apps <= 1.4.9.1 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-33538
Apr 25, 2024
Researcher: Joshua Chan
Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
9.8
CVE-2024-3962
Apr 25, 2024
Researcher: andrea bocchetti
Serious Slider <= 1.2.4 - Cross-Site Request Forgery
4.3
CVE-2024-33650
Apr 25, 2024
Researcher: Steven Julian
Advanced Most Recent Posts Mod <= 1.6.5.2 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-33643
Apr 25, 2024
Researcher: Ngô Thiên An (ancorn_)
Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Local File Inclusion
8.8
CVE-2024-33541
Apr 25, 2024
Researcher: Ray Wilson
WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files
5.3
CVE-2024-2920
Apr 25, 2024
Researcher: Tim Coen
Title CVE ID CVSS Researchers Date
Multiple Plugins by tychesoftwares <= (Various Versions) - Missing Authorization to Notice Dismissal CVE-2024-4233 4.3 Dhabaleshwar Das April 26, 2024
ColibriWP Theme framework <= (Various Versions) - Missing Authorization CVE-2024-33686 4.3 Dhabaleshwar Das April 26, 2024
Meks Smart Social Widget <= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-33693 4.4 Joshua Chan April 26, 2024
WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-1572 6.4 Richard Telleng (stueotue) April 26, 2024
WP GDPR Compliance <= 2.0.23 - Cross-Site Request Forgery CVE-2024-33682 4.3 Mika April 26, 2024
Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner CVE-2024-3819 6.4 wesley (wcraft) April 26, 2024
Knowledge Base documentation & wiki plugin – BasePress <= 2.16.1 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2024-33590 6.4 beluga April 25, 2024
XStore Core <= 5.3.5 - Missing Authorization CVE-2024-33555 6.3 Rafie Muhammad April 25, 2024
XStore Core <= 5.3.5 - Authenticated (Subscriber+) Limited Arbitrary File Upload CVE-2024-33556 9.9 Rafie Muhammad April 25, 2024
XStore <= 9.3.5 - Missing Authorization CVE-2024-33563 4.3 Rafie Muhammad April 25, 2024
Element Pack Pro <= 7.7.4 - Authenticated (Contributor+) Arbitrary File Read and PHAR Deserialization CVE-2024-33568 9.9 Rafie Muhammad April 25, 2024
Radio Player <= 2.0.73 - Unauthenticated Server-Side Request Forgery CVE-2024-33592 7.2 Steven Julian April 25, 2024
Piotnet Addons For Elementor Pro <= 7.1.17 - Reflected Cross-Site Scripting CVE-2024-33633 6.1 Dave Jong April 25, 2024
Crelly Slider <= 1.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2024-33542 5.4 Steven Julian April 25, 2024
Assistant – Every Day Productivity Apps <= 1.4.9.1 - Unauthenticated Sensitive Information Exposure CVE-2024-33538 5.3 Joshua Chan April 25, 2024
Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file CVE-2024-3962 9.8 andrea bocchetti April 25, 2024
Serious Slider <= 1.2.4 - Cross-Site Request Forgery CVE-2024-33650 4.3 Steven Julian April 25, 2024
Advanced Most Recent Posts Mod <= 1.6.5.2 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-33643 6.4 Ngô Thiên An (ancorn_) April 25, 2024
Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Local File Inclusion CVE-2024-33541 8.8 Ray Wilson April 25, 2024
WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files CVE-2024-2920 5.3 Tim Coen April 25, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Apr 2, 2024
Vulns
1 Dhabaleshwar Das 80
2 Rafie Muhammad 49
3 Joshua Chan 45
4 Krzysztof Zając 44
5 Majed Refaea 39
6 stealthcopter 39
7 Ngô Thiên An (ancorn_) 34
8 Francesco Carlucci 34
9 wesley (wcraft) 29
10 Lucio Sá 28
11 Abdi Pranata 28
12 Dave Jong 27
13 Steven Julian 23
14 beluga 23
15 Khalid 22
16 LVT-tholv2k 20
17 Dimas Maulana 18
18 Webbernaut 18
19 Mika 16
20 Tim Coen 13

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation