VMP™ Security Intelligence

WordPress vulnerability database

2,012 known vulnerabilities across WordPress core, plugins, and themes — updated daily.

Search the database

All vulnerabilities

Submit vulnerability
Title CVE ID Severity CVSS Component Published
lib/core CVE-2015-7527 unknown N/A WordPress core Dec 17, 2015
Multiple SQL injection vulnerabilities in cs_admin_users CVE-2015-5308 unknown N/A WordPress core Nov 2, 2015
Absolute path traversal vulnerability in Font CVE-2015-7683 unknown N/A WordPress core Oct 16, 2015
Multiple SQL injection vulnerabilities in pie-register/pie-register CVE-2015-7682 unknown N/A WordPress core Oct 16, 2015
Cross-site scripting (XSS) vulnerability in pie-register/pie-register CVE-2015-7377 unknown N/A WordPress core Oct 16, 2015
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list CVE-2015-7320 unknown N/A WordPress core Sep 29, 2015
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list CVE-2015-7319 unknown N/A WordPress core Sep 29, 2015
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes CVE-2015-7386 unknown N/A WordPress core Sep 28, 2015
Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6 CVE-2015-6238 unknown N/A WordPress core Sep 21, 2015
Multiple SQL injection vulnerabilities in dex_reservations CVE-2015-7235 unknown N/A WordPress core Sep 17, 2015
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2 CVE-2015-6965 unknown N/A WordPress core Sep 16, 2015
Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts CVE-2015-6829 unknown N/A WordPress core Sep 16, 2015
The tweet_info function in class/__functions CVE-2015-6828 unknown N/A WordPress core Sep 16, 2015
Absolute path traversal vulnerability in lib/download CVE-2015-5472 unknown N/A WordPress core Sep 15, 2015
Cross-site scripting (XSS) vulnerability in js/window CVE-2015-6920 unknown N/A WordPress core Sep 11, 2015
Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1 CVE-2015-6805 unknown N/A WordPress core Sep 2, 2015
Cross-site scripting (XSS) vulnerability in js/window CVE-2015-2807 unknown N/A WordPress core Sep 1, 2015
Cross-site scripting (XSS) vulnerability in includes/options-profiles CVE-2015-6535 unknown N/A WordPress core Aug 31, 2015
Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1 CVE-2015-6523 unknown N/A WordPress core Aug 19, 2015
SQL injection vulnerability in the WP Symposium plugin before 15 CVE-2015-6522 unknown N/A WordPress core Aug 19, 2015

Page 1 of 101 (2,012 vulnerabilities)

Report a vulnerability

Found a vulnerability in a WordPress plugin or theme? Submit it through our disclosure program — we handle the CVE request and vendor notification on your behalf.

Submit vulnerability

Request a CVE ID

Researchers can request CVE identifiers for new WordPress vulnerabilities directly through VMP™ Security.

Request CVE

Protect your site

VMP™ Security checks your WordPress site against this vulnerability database automatically, so you hear about a match before it becomes a problem.

Get protected