What this plugin does

• Slug: wordfence
• Author: Mark Maunder
• 5000000+ active installs
• 94/100 rating (4979 reviews on wordpress.org)
• 423147140 all-time downloads
• On WordPress.org since 2012-04-21

2FAfirewallmalwarescannersecurity

Maintenance status

• Latest known version: 8.2.2
• Last updated: 2026-08-10 4:22pm GMT
• Tested up to WordPress: 7.1
• Requires PHP: 7.0+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

4 known CVEs on file for Wordfence Security. Reported between 2012 and 2022.

+ 36 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Unknown	< 5.2.5	5.2.5	2015-05-15	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3	—	Unknown	< 5.2.3	5.2.3	2015-05-15	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Unknown	< 3.8.3	3.8.3	2015-05-15	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Unknown	< 3.3.7	3.3.7	2015-05-15	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Unknown	< 5.2.5	5.2.5	2015-05-15	✓ fixed in latest
CVE-2014-4932	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.1.5	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 5.1.5	5.1.5	2014-12-08	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Unknown	< 5.2.4	5.2.4	2014-09-27	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] <= 5.2.3	—	Unknown	< 5.2.3	5.2.3	2014-09-14	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Unknown	< 5.2.4	5.2.4	2014-09-14	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Unknown	< 5.2.4	5.2.4	2014-09-14	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3	—	Unknown	< 5.2.3	5.2.3	2014-09-08	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Unknown	< 3.8.3	3.8.3	2014-08-01	✓ fixed in latest
CVE-2014-4664	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Unknown	< 5.2.5	5.2.5	2014-06-26	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Unknown	< 3.3.7	3.3.7	2012-10-19	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Unknown	< 3.3.7	3.3.7	2012-10-19	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.6	—	Unknown	< 3.3.6	3.3.6	2012-10-18	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 7.1.14	—	Unknown	< 7.1.14	7.1.14	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3	—	Unknown	< 5.2.3	5.2.3	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Unknown	< 5.2.4	5.2.4	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Unknown	< 5.2.4	5.2.4	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Unknown	< 5.2.5	5.2.5	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Unknown	< 5.2.5	5.2.5	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Unknown	< 3.3.7	3.3.7	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Unknown	< 3.8.3	3.8.3	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Unknown	< 3.8.3	3.8.3	—	✓ fixed in latest
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.7	—	Unknown	< 3.8.7	3.8.7	—	✓ fixed in latest
—	Wordfence 3.8.6 - lib/IPTraf.php User-Agent Header Stored XSS	—	Unknown	< 3.8.7	3.8.7	—	✓ fixed in latest
—	Wordfence 3.8.1 - Password Creation Restriction Bypass	—	Unknown	< 3.8.3	3.8.3	—	✓ fixed in latest
—	Wordfence 3.8.1 - wp-admin/admin.php whois Parameter Stored XSS	—	Unknown	< 3.8.3	3.8.3	—	✓ fixed in latest
—	Wordfence 3.3.5 - XSS & IAA	—	Unknown	< 3.3.7	3.3.7	—	✓ fixed in latest
—	Wordfence 5.2.4 - Unspecified Issue	—	Unknown	< 5.2.5	5.2.5	—	✓ fixed in latest
—	Wordfence 5.2.4 - IPTraf.php URI Request Stored XSS	—	Unknown	< 5.2.5	5.2.5	—	✓ fixed in latest
—	Wordfence 5.2.3 - Banned IP Functionality Bypass	—	Unknown	< 5.2.4	5.2.4	—	✓ fixed in latest
—	Wordfence 5.2.3 - Multiple Vulnerabilities	—	Unknown	< 5.2.4	5.2.4	—	✓ fixed in latest
—	Wordfence 5.2.2 - XSS in Referer Header	—	Unknown	< 5.2.3	5.2.3	—	✓ fixed in latest
—	Wordfence < 7.1.14 - Username Enumeration Prevention Bypass	—	Unknown	< 7.1.14	7.1.14	—	✓ fixed in latest

How to fix it

Keep Wordfence Security updated — 8.2.2 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ active installs — 98/100 (8861) — max PHP 8.4
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention — 1000000+ active installs — 96/100 (1477) — max PHP 8.4
• Security Optimizer – The All-In-One Protection Plugin — 1000000+ active installs — 90/100 (157) — max PHP <8.0
• All-In-One Security (AIOS) – Security and Firewall — 1000000+ active installs — 94/100 (1715)
• Sucuri Security – Auditing, Malware Scanner and Security Hardening — 600000+ active installs — 84/100 (384)