Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 103 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-178911d9 | event-post < 5.9.6 |
CRITICAL | 9.8 | The Event post plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.9.5 vi… | 5.9.6 | wordfence |
| WF-17641096 | personalization-by-flowcraft | CRITICAL | 9.8 | The Advanced Personalization plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including… | — | wordfence |
| WF-16e3ca1b | mstore-api < 3.2.0 |
CRITICAL | 9.8 | A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign… | 3.2.0 | wordfence |
| WF-16c0a3b7 | member-hero | CRITICAL | 9.8 | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter… | — | wordfence |
| WF-16bce38a | simple-link-directory < 7.7.2 |
CRITICAL | 9.8 | The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using … | 7.7.2 | wordfence |
| WF-16af4d96 | contus-video-comments | CRITICAL | 9.8 | The Contus Video Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… | — | wordfence |
| WF-169d06e1 | wp-registration < 6.8 |
CRITICAL | 9.8 | The Simple User Registration plugin for WordPress is vulnerable to privilege escalation due to a missing capability chec… | 6.8 | wordfence |
| WF-167436b7 | noo-jobmonster < 4.7.6 |
CRITICAL | 9.8 | The Noo JobMonster theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7.5… | 4.7.6 | wordfence |
| WF-1672e8fb | user-files | CRITICAL | 9.8 | The user files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all v… | — | wordfence |
| WF-162a9203 | polls-widget < 1.5.3 |
CRITICAL | 9.8 | The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the… | 1.5.3 | wordfence |
| WF-15fecefa | holding_pattern | CRITICAL | 9.8 | Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 a… | — | wordfence |
| WF-15f23748 | checkout-files-upload-woocommerce < 2.4.0 |
CRITICAL | 9.8 | The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up… | 2.4.0 | wordfence |
| WF-15deb0db | wp-ultimate-exporter < 1.2 |
CRITICAL | 9.8 | The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. | 1.2 | wordfence |
| WF-159304a1 | kadence-woocommerce-email-designer < 1.5.19.1 |
CRITICAL | 9.8 | The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,… | 1.5.19.1 | wordfence |
| WF-1560b740 | limit-attempts < 1.1.1 |
CRITICAL | 9.8 | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. | 1.1.1 | wordfence |
| WF-155e3de1 | wp-post-author < 3.3.0 |
CRITICAL | 9.8 | The WP Post Author plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.2.3. T… | 3.3.0 | wordfence |
| WF-1540bf3e | realhomes < 4.3.7 |
CRITICAL | 9.8 | The RealHomes theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.6. Thi… | 4.3.7 | wordfence |
| WF-153e435b | zendrop-dropshipping-and-fulfillment < 1.0.1 |
CRITICAL | 9.8 | The Zendrop – Global Dropshipping plugin for WordPress is vulnerable to generic SQL Injection via the setMetaData func… | 1.0.1 | wordfence |
| WF-14f86410 | uploader | CRITICAL | 9.8 | The Uploader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '/u… | — | wordfence |
| WF-14d48a81 | advanced-cf7-db < 1.7.0 |
CRITICAL | 9.8 | A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successfu… | 1.7.0 | wordfence |
| WF-14a1b8af | wpcargo < 6.9.0 |
CRITICAL | 9.8 | The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to w… | 6.9.0 | wordfence |
| WF-14981949 | findall-listing < 1.1 |
CRITICAL | 9.8 | The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0… | 1.1 | wordfence |
| WF-146c8783 | google-document-embedder < 2.5.17 |
CRITICAL | 9.8 | SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote atta… | 2.5.17 | wordfence |
| WF-144df910 | participants-database < 1.5.4.9 |
CRITICAL | 9.8 | SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allo… | 1.5.4.9 | wordfence |
| WF-13b4efa1 | podcasting < 3.0.5 |
CRITICAL | 9.8 | The Podcasting Plugin by TSG plugin for WordPress is vulnerable to Remote File Inclusion of media files in versions up t… | 3.0.5 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →