WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Mobile Assistant Connector <= 2.2.2 - SQL Injection
9.8
CVE ID Unknown
Aug 7, 2022
Researchers:
WordPress HTTPS (SSL) <= 3.4.0 - Missing Authorization to Settings Change
7.1
CVE ID Unknown
Aug 6, 2022
Researchers:
Frontend File Manager & Sharing – User Private Files <= 1.1.0 - Sensitive Information Disclosure
5.3
CVE ID Unknown
Aug 6, 2022
Researchers:
Frontend File Manager & Sharing – User Private Files <= 1.1.1 - Missing Authorization
6.3
CVE ID Unknown
Aug 6, 2022
Researchers:
WPCafe – Food Menu, WooCommerce Food Ordering, Food Delivery, Pickup and Restaurant Reservation <= 2.1.4 - Cross-Site Scripting
7.2
CVE ID Unknown
Aug 6, 2022
Researchers:
WordPress to Hootsuite <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting
5.5
CVE ID Unknown
Aug 5, 2022
Researchers:
WordPress to Buffer <= 3.8.1 - Authenticated (Admin+) Cross-Site Scripting
5.5
CVE ID Unknown
Aug 5, 2022
Researchers:
WooCommerce Product Carousel, Slider & Grid Ultimate <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE ID Unknown
Aug 5, 2022
Researchers:
WP-MUI – Mass User Input – Add and Export WP Users Quickly <= 1.8 - Missing Authorization
6.3
CVE ID Unknown
Aug 5, 2022
Researchers:
Testimonial Slider <= 2.2.6 - Stored Cross-Site Scripting
6.4
CVE ID Unknown
Aug 5, 2022
Researchers:
PostmagThemes Demo Import <= 1.0.6 - Authenticated (Admin+) Arbitrary File Upload
7.2
CVE ID Unknown
Aug 5, 2022
Researchers:
Contempo Real Estate Custom Posts <= 3.2.6 - Unauthorized File Upload
8.8
CVE ID Unknown
Aug 5, 2022
Researchers:
Minimal Coming Soon – Coming Soon Page <= 2.33 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE ID Unknown
Aug 5, 2022
Researchers:
Twitter Bootstrap Slider <= 1.1.3 - Authenticated (Admin+) Cross-Site Scripting
5.5
CVE ID Unknown
Aug 5, 2022
Researchers:
Cyclone Slider <= 3.2.0 - Authenticated (Admin+) Arbitrary File Upload
7.2
CVE ID Unknown
Aug 5, 2022
Researchers:
Simple Telegram <= 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE ID Unknown
Aug 5, 2022
Researchers:
Protect WP Admin <= 3.7 - Cross-Site Scripting
6.1
CVE ID Unknown
Aug 5, 2022
Researchers:
Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Cross-Site Request Forgery
8.8
CVE-2022-2657
Aug 4, 2022
Researcher: moumitahalder
Sensei LMS <= 4.5.1 - Missing Authorization
4.3
CVE-2022-2080
Aug 4, 2022
Researcher: Veshraj Ghimire
Download Manager <= 3.2.53 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Aug 4, 2022
Researchers:
Title CVE ID CVSS Researchers Date
Mobile Assistant Connector <= 2.2.2 - SQL Injection 9.8 August 7, 2022
WordPress HTTPS (SSL) <= 3.4.0 - Missing Authorization to Settings Change 7.1 August 6, 2022
Frontend File Manager & Sharing – User Private Files <= 1.1.0 - Sensitive Information Disclosure 5.3 August 6, 2022
Frontend File Manager & Sharing – User Private Files <= 1.1.1 - Missing Authorization 6.3 August 6, 2022
WPCafe – Food Menu, WooCommerce Food Ordering, Food Delivery, Pickup and Restaurant Reservation <= 2.1.4 - Cross-Site Scripting 7.2 August 6, 2022
WordPress to Hootsuite <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting 5.5 August 5, 2022
WordPress to Buffer <= 3.8.1 - Authenticated (Admin+) Cross-Site Scripting 5.5 August 5, 2022
WooCommerce Product Carousel, Slider & Grid Ultimate <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 August 5, 2022
WP-MUI – Mass User Input – Add and Export WP Users Quickly <= 1.8 - Missing Authorization 6.3 August 5, 2022
Testimonial Slider <= 2.2.6 - Stored Cross-Site Scripting 6.4 August 5, 2022
PostmagThemes Demo Import <= 1.0.6 - Authenticated (Admin+) Arbitrary File Upload 7.2 August 5, 2022
Contempo Real Estate Custom Posts <= 3.2.6 - Unauthorized File Upload 8.8 August 5, 2022
Minimal Coming Soon – Coming Soon Page <= 2.33 - Authenticated (Admin+) Stored Cross-Site Scripting 5.5 August 5, 2022
Twitter Bootstrap Slider <= 1.1.3 - Authenticated (Admin+) Cross-Site Scripting 5.5 August 5, 2022
Cyclone Slider <= 3.2.0 - Authenticated (Admin+) Arbitrary File Upload 7.2 August 5, 2022
Simple Telegram <= 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting 5.5 August 5, 2022
Protect WP Admin <= 3.7 - Cross-Site Scripting 6.1 August 5, 2022
Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Cross-Site Request Forgery CVE-2022-2657 8.8 moumitahalder August 4, 2022
Sensei LMS <= 4.5.1 - Missing Authorization CVE-2022-2080 4.3 Veshraj Ghimire August 4, 2022
Download Manager <= 3.2.53 - Reflected Cross-Site Scripting 6.1 August 4, 2022
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Apr 15, 2024
Vulns
1 stealthcopter 52
2 Dhabaleshwar Das 46
3 Rafie Muhammad 41
4 Ngô Thiên An (ancorn_) 39
5 Krzysztof Zając 38
6 Joshua Chan 35
7 wesley (wcraft) 34
8 Francesco Carlucci 30
9 Lucio Sá 24
10 Steven Julian 23
11 Dave Jong 19
12 Webbernaut 19
13 Majed Refaea 19
14 LVT-tholv2k 18
15 Abdi Pranata 18
16 Benedictus Jovan (aillesiM) 17
17 Khalid 16
18 Bob Matyas 13
19 beluga 13
20 Peng Zhou 11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation