WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery
4.3
CVE-2024-1467
May 8, 2024
Researcher: Lucio Sá
Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode
6.4
CVE-2024-4567
May 8, 2024
Researcher: Francesco Carlucci
Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
8.8
CVE-2024-3808
May 8, 2024
Researcher: István Márton
Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta
8.8
CVE-2024-3809
May 8, 2024
Researcher: István Márton
Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution
8.8
CVE-2024-4605
May 8, 2024
Researcher: Francesco Carlucci
Heateor Social Login WordPress <= 1.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-32674
May 8, 2024
Researcher: Daiki Sato
Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
9.8
CVE-2024-3806
May 8, 2024
Researcher: István Márton
Playlist for Youtube <= 1.32 - Authenticated (Editor+) Stored Cross-Site Scripting
5.5
CVE-2024-3937
May 8, 2024
Researcher: Erdemstar
Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget
6.4
CVE-2024-3831
May 8, 2024
Researcher: Sebastião Gavião (Sebastgav)
Pure Chat – Live Chat Plugin & More! <= 2.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-3595
May 8, 2024
Researcher: Lucio Sá
Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag
6.4
CVE-2024-3680
May 8, 2024
Researcher: Sebastião Gavião (Sebastgav)
SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Page Title
6.4
CVE-2024-34445
May 7, 2024
Researcher: Khalid
Move Addons for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-34562
May 7, 2024
Researcher: Khalid
Social Connect <= 1.2 - Authentication Bypass
9.8
CVE-2024-4393
May 7, 2024
Researcher: István Márton
Ghost <= 1.4.0 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-34559
May 7, 2024
Researcher: Joshua Chan
Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode
6.4
CVE-2024-4281
May 7, 2024
Researcher: Krzysztof Zając
Ultimate Store Kit Elementor Addons <= 1.6.2 - Unauthenticated PHP Object Injection
9.8
CVE-2024-4606
May 7, 2024
Researcher: Ray Wilson
Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Unauthenticated Information Exposure
5.3
CVE-2024-34556
May 7, 2024
Researcher: Dhabaleshwar Das
Stockholm Core <= 2.4.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-34553
May 7, 2024
Researcher: Rafie Muhammad
SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update
4.3
CVE-2024-1693
May 7, 2024
Researcher: fewwords huang
Title CVE ID CVSS Researchers Date
Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery CVE-2024-1467 4.3 Lucio Sá May 8, 2024
Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode CVE-2024-4567 6.4 Francesco Carlucci May 8, 2024
Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode CVE-2024-3808 8.8 István Márton May 8, 2024
Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta CVE-2024-3809 8.8 István Márton May 8, 2024
Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution CVE-2024-4605 8.8 Francesco Carlucci May 8, 2024
Heateor Social Login WordPress <= 1.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-32674 6.4 Daiki Sato May 8, 2024
Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts CVE-2024-3806 9.8 István Márton May 8, 2024
Playlist for Youtube <= 1.32 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-3937 5.5 Erdemstar May 8, 2024
Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget CVE-2024-3831 6.4 Sebastião Gavião (Sebastgav) May 8, 2024
Pure Chat – Live Chat Plugin & More! <= 2.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-3595 6.4 Lucio Sá May 8, 2024
Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag CVE-2024-3680 6.4 Sebastião Gavião (Sebastgav) May 8, 2024
SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Page Title CVE-2024-34445 6.4 Khalid May 7, 2024
Move Addons for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-34562 6.4 Khalid May 7, 2024
Social Connect <= 1.2 - Authentication Bypass CVE-2024-4393 9.8 István Márton May 7, 2024
Ghost <= 1.4.0 - Unauthenticated Sensitive Information Exposure CVE-2024-34559 5.3 Joshua Chan May 7, 2024
Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode CVE-2024-4281 6.4 Krzysztof Zając May 7, 2024
Ultimate Store Kit Elementor Addons <= 1.6.2 - Unauthenticated PHP Object Injection CVE-2024-4606 9.8 Ray Wilson May 7, 2024
Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Unauthenticated Information Exposure CVE-2024-34556 5.3 Dhabaleshwar Das May 7, 2024
Stockholm Core <= 2.4.1 - Reflected Cross-Site Scripting CVE-2024-34553 6.1 Rafie Muhammad May 7, 2024
SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update CVE-2024-1693 4.3 fewwords huang May 7, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Apr 17, 2024
Vulns
1 stealthcopter 58
2 Dhabaleshwar Das 46
3 Ngô Thiên An (ancorn_) 37
4 Krzysztof Zając 35
5 Rafie Muhammad 35
6 wesley (wcraft) 33
7 Joshua Chan 32
8 Bob Matyas 29
9 Francesco Carlucci 24
10 Lucio Sá 23
11 Steven Julian 22
12 Benedictus Jovan (aillesiM) 18
13 Webbernaut 18
14 Khalid 16
15 Majed Refaea 16
16 Abdi Pranata 16
17 Dave Jong 15
18 Peng Zhou 12
19 István Márton 11
20 LVT-tholv2k 11

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation