WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
BookingPress <= 1.0.81 - Authenticated (Customer+) Insecure Direct Object Reference
4.3
CVE-2024-31296
Apr 5, 2024
Researcher: Steven Julian
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode
6.4
CVE-2024-3267
Apr 5, 2024
Researcher: stealthcopter
Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-2458
Apr 5, 2024
Researcher: Francesco Carlucci
Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-2439
Apr 5, 2024
Researcher: cyc707
FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-2081
Apr 5, 2024
Researcher: Robert Kruczek (ProXy)
WP Sort Order <= 1.3.1 - Missing Authorization
4.3
CVE-2024-31294
Apr 5, 2024
Researcher: CatFather
Edwiser Bridge <= 3.0.2 - Authenticated (Administrator+) SQL Injection
9.1
CVE-2024-31260
Apr 5, 2024
Researcher: Muhammad Daffa
Easy Login Styler – White Label Admin Login Page for WordPress <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-31344
Apr 5, 2024
Researcher: Cronus
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion
5.3
CVE-2024-31243
Apr 5, 2024
Researcher: Dave Jong
EmbedPress <= 3.9.8 - Missing Authorization via handle_calendly_data
5.3
CVE-2024-31284
Apr 5, 2024
Researcher: Majed Refaea
WordPress Gallery Exporter <= 1.3 - Authenticated (Administrator+) Arbitrary File Download
2.7
CVE-2024-31342
Apr 5, 2024
Researcher: Abdi Prawira Negara
Captcha by BestWebSoft <= 5.2.0 - Captcha Bypass
5.3
CVE-2024-31295
Apr 5, 2024
Researcher: qilin_99
Generate Child Theme <= 2.0 - Cross-Site Request Forgery via process_create_form()
4.3
CVE-2024-31279
Apr 5, 2024
Researcher: Abdi Pranata
ProfileGrid <= 5.7.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2024-31291
Apr 5, 2024
Researcher: Kyle Sanchez
Demo My WordPress <= 1.0.9.1 - Unauthenticated Privilege Escalation
9.8
CVE-2024-31290
Apr 5, 2024
Researcher: Dave Jong
Transcoder <= 1.3.5 - Cross-Site Request Forgery
4.3
CVE-2024-31305
Apr 5, 2024
Researcher: Majed Refaea
Hello Elementor <= 3.0.0 - Cross-Site Request Forgery to Notice Dismissal
4.3
CVE-2024-31289
Apr 5, 2024
Researcher: Dhabaleshwar Das
Email Subscribers & Newsletters <= 5.7.13 - Missing Authorization
5.3
CVE-2024-31352
Apr 5, 2024
Researcher: Kévin Mosbahi (Mika)
BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.14 - Information Exposure
5.3
CVE-2024-2950
Apr 5, 2024
Researcher: Krzysztof Zając
FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields
6.4
CVE-2024-2471
Apr 5, 2024
Researcher: Tim Coen
Title CVE ID CVSS Researchers Date
BookingPress <= 1.0.81 - Authenticated (Customer+) Insecure Direct Object Reference CVE-2024-31296 4.3 Steven Julian April 5, 2024
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode CVE-2024-3267 6.4 stealthcopter April 5, 2024
Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-2458 6.4 Francesco Carlucci April 5, 2024
Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-2439 4.4 cyc707 April 5, 2024
FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-2081 6.4 Robert Kruczek (ProXy) April 5, 2024
WP Sort Order <= 1.3.1 - Missing Authorization CVE-2024-31294 4.3 CatFather April 5, 2024
Edwiser Bridge <= 3.0.2 - Authenticated (Administrator+) SQL Injection CVE-2024-31260 9.1 Muhammad Daffa April 5, 2024
Easy Login Styler – White Label Admin Login Page for WordPress <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-31344 4.4 Cronus April 5, 2024
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion CVE-2024-31243 5.3 Dave Jong April 5, 2024
EmbedPress <= 3.9.8 - Missing Authorization via handle_calendly_data CVE-2024-31284 5.3 Majed Refaea April 5, 2024
WordPress Gallery Exporter <= 1.3 - Authenticated (Administrator+) Arbitrary File Download CVE-2024-31342 2.7 Abdi Prawira Negara April 5, 2024
Captcha by BestWebSoft <= 5.2.0 - Captcha Bypass CVE-2024-31295 5.3 qilin_99 April 5, 2024
Generate Child Theme <= 2.0 - Cross-Site Request Forgery via process_create_form() CVE-2024-31279 4.3 Abdi Pranata April 5, 2024
ProfileGrid <= 5.7.6 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2024-31291 4.3 Kyle Sanchez April 5, 2024
Demo My WordPress <= 1.0.9.1 - Unauthenticated Privilege Escalation CVE-2024-31290 9.8 Dave Jong April 5, 2024
Transcoder <= 1.3.5 - Cross-Site Request Forgery CVE-2024-31305 4.3 Majed Refaea April 5, 2024
Hello Elementor <= 3.0.0 - Cross-Site Request Forgery to Notice Dismissal CVE-2024-31289 4.3 Dhabaleshwar Das April 5, 2024
Email Subscribers & Newsletters <= 5.7.13 - Missing Authorization CVE-2024-31352 5.3 Kévin Mosbahi (Mika) April 5, 2024
BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.14 - Information Exposure CVE-2024-2950 5.3 Krzysztof Zając April 5, 2024
FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields CVE-2024-2471 6.4 Tim Coen April 5, 2024
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 11, 2026
Vulns
1 Ananda Dhakal 168
2 Wordfence PRISM 66
3 Intrudify 46
4 Karthik Ramakrishnan 34
5 Jakub Herman 32
6 Artus KG 32
7 nh4tvd 31
8 daroo 19
9 Rafie Muhammad 19
10 neurotx 18
11 Pablo González Pérez 18
12 Francisco José Ramírez Vicente 18
13 Iñigo Sánchez Enciso 18
14 Erwan LR 18
15 JunHee CHO 17
16 Supakiad S. (m3ez) 16
17 Peter Tang 16
18 Kuba 15
19 vuxvinh 15
20 Naoki Kawahigashi 14

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation