WordPress plugin

Wordfence Security – Firewall, Malware Scan, and Login Security security & vulnerabilities

Q: Does Wordfence Security – Firewall, Malware Scan, and Login Security have known vulnerabilities?

Yes. VulnCrest Radar lists 12 known vulnerabilities in Wordfence Security – Firewall, Malware Scan, and Login Security: 5 high, 7 medium. None are known to affect version null.

Q: How do I check which version of Wordfence Security – Firewall, Malware Scan, and Login Security I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Wordfence Security – Firewall, Malware Scan, and Login Security vulnerability?

CVE-2022-3144, published Sep 6, 2022: Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting. Severity: Medium (CVSS 4.4).

Q: Is any Wordfence Security – Firewall, Malware Scan, and Login Security vulnerability listed in CISA KEV?

No. None of the known Wordfence Security – Firewall, Malware Scan, and Login Security vulnerabilities is currently listed in the CISA KEV catalog.

wordfence— active installsLast vulnerability Sep 6, 2022

No known unpatched vulnerabilities in the latest version

All 12 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

12Known vulnerabilities

Critical0
High5
Medium7
Low0

Vulnerabilities per year

All Wordfence Security – Firewall, Malware Scan, and Login Security vulnerabilities

Wordfence Security – Firewall, Malware Scan, and Login Security vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Stored Cross-Site Scripting via HTTP_HOST ≤5.2.3Update to 5.2.4	—	Sep 27, 2014
High7.2	Stored Cross-Site Scripting via REQUEST_URI ≤5.2.3Update to 5.2.4	—	Sep 14, 2014
High7.2	Stored Cross-Site Scripting <5.2.3Update to 5.2.3	—	Sep 8, 2014
High7.2	Stored Cross-Site Scripting ≤3.8.1Update to 3.8.3	—	Aug 1, 2014
High7.2	Cross-Site Scripting ≤5.1.3Update to 5.1.4	CVE-2014-4664	Jul 30, 2014

High7.2
Stored Cross-Site Scripting via HTTP_HOST
≤5.2.3Update to 5.2.4
47938357-7d51-4d62-a08c-4b2bf3f3a062Sep 27, 2014
High7.2
Stored Cross-Site Scripting via REQUEST_URI
≤5.2.3Update to 5.2.4
fdfa2336-dda2-4945-9278-1a85f8b5f88bSep 14, 2014
High7.2
Stored Cross-Site Scripting
<5.2.3Update to 5.2.3
f315fff8-d616-4a5c-91bc-d8b0ec0f028fSep 8, 2014
High7.2
Stored Cross-Site Scripting
≤3.8.1Update to 3.8.3
63a2d09d-9cb8-47ba-8e40-5b43894552e3Aug 1, 2014
High7.2
Cross-Site Scripting
≤5.1.3Update to 5.1.4
CVE-2014-4664Jul 30, 2014

Wordfence Security – Firewall, Malware Scan, and Login Security: common questions

Does Wordfence Security – Firewall, Malware Scan, and Login Security have known vulnerabilities?

Yes. VulnCrest Radar lists 12 known vulnerabilities in Wordfence Security – Firewall, Malware Scan, and Login Security: 5 high, 7 medium. None are known to affect version null.

How do I check which version of Wordfence Security – Firewall, Malware Scan, and Login Security I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Wordfence Security – Firewall, Malware Scan, and Login Security vulnerability?

CVE-2022-3144, published Sep 6, 2022: Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting. Severity: Medium (CVSS 4.4).

Is any Wordfence Security – Firewall, Malware Scan, and Login Security vulnerability listed in CISA KEV?

No. None of the known Wordfence Security – Firewall, Malware Scan, and Login Security vulnerabilities is currently listed in the CISA KEV catalog.