HomeWordPress vulnerabilitiesWordfence Security
Wordfence Security vulnerabilities
Wordfence Security has 4 known vulnerabilities in this database. The most recent published record is dated 23 Sep 2022.
- Known vulnerabilities
- 4
- Active installs
- 5m+
- Latest version
- 9.0.2
- Last updated
- 30 Sep 2026
- Most recent
- 23 Sep 2022
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site scripting (XSS) CVE-2022-3144 | Medium 4.4 | Up to 7.6.0 | Fixed in a later version (latest 9.0.2) | 23 Sep 2022 |
| Cross-site scripting (XSS) CVE-2019-9669 | Medium 6.1 | Not yet published | Check for an update | 25 Apr 2019 |
| Cross-site scripting (XSS) CVE-2014-4932 | Medium 6.1 | Before 5.1.5 | Fixed in 5.1.5 | 28 Aug 2018 |
| Cross-site scripting (XSS) CVE-2014-4664 | Not scored | Before 5.1.4 | Fixed in 5.1.4 | 6 Nov 2014 |
Read the published descriptions
- CVE-2022-3144, 23 Sep 2022
- The Wordfence Security - Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version. CVE record
- CVE-2019-9669, 25 Apr 2019
- The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities) CVE record
- CVE-2014-4932, 28 Aug 2018
- Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php. CVE record
- CVE-2014-4664, 6 Nov 2014
- Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php. CVE record
What to do if you run Wordfence Security
If you run Wordfence Security, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Wordfence Security vulnerabilities
Free. We email you when a new vulnerability is published for Wordfence Security, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.