wordfence vulnerabilities

Products

• wordfence security 2

Latest wordfence CVEs

Newest publication first

1. CVE-2022-3144 Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting

   Published 2022-09-23

   Medium·CVSS 4.8 EPSS 0.84%

   The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated us...

2. CVE-2014-4932 Wordfence <= 5.1.4 - Reflected Cross-Site Scripting

   Published 2018-08-28

   Medium·CVSS 6.1 EPSS 1.2%

   Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.