Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 117 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-a147956c | pitchprint < 11.2.0 |
CRITICAL | 9.1 | The PitchPrint plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… | 11.2.0 | wordfence |
| WF-a125bbf1 | startklar-elmentor-forms-extwidgets < 1.7.14 |
CRITICAL | 9.1 | The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and … | 1.7.14 | wordfence |
| WF-a0b5f2ae | woocommerce-checkout-field-editor-pro < 3.8.1 |
CRITICAL | 9.1 | The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary… | 3.8.1 | wordfence |
| WF-9e20afee | wd-google-maps | CRITICAL | 9.1 | The 10Web Map Builder for Google Maps plugin for WordPress is vulnerable to SQL Injection in versions up to, and includi… | — | wordfence |
| WF-9cb7bc91 | wp-graphql < 0.3.0 |
CRITICAL | 9.1 | An issue was discovered in WPGraphQL up to 0.2.3 . By querying the 'users' RootQuery, it is possible, for an unauthentic… | 0.3.0 | wordfence |
| WF-9affd2b9 | cbxwpbookmark < 1.7.21 |
CRITICAL | 9.1 | The CBX Bookmark & Favorite plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.7.20… | 1.7.21 | wordfence |
| WF-9addaa26 | shortcode-addons | CRITICAL | 9.1 | The Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension plugin for WordPress is vulnera… | — | wordfence |
| WF-9a5ce873 | wp-all-import < 3.6.8 |
CRITICAL | 9.1 | The WP All Import plugin for WordPress is vulnerable to arbitrary code execution in versions up to, and including, 3.6.7… | 3.6.8 | wordfence |
| WF-9a29aea7 | wordpress-database-reset < 3.15 |
CRITICAL | 9.1 | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any … | 3.15 | wordfence |
| WF-98a274eb | learnpress-import-export < 4.0.4 |
CRITICAL | 9.1 | The LearnPress Export Import plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.0.3… | 4.0.4 | wordfence |
| WF-97416640 | google-adsense-and-hotel-booking | CRITICAL | 9.1 | Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05 | — | wordfence |
| WF-9715d1b2 | ai-engine < 2.2.70 |
CRITICAL | 9.1 | The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all ve… | 2.2.70 | wordfence |
| WF-96e2ba3d | fgallery < 2.4.2 |
CRITICAL | 9.1 | SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute… | 2.4.2 | wordfence |
| WF-93d00b7e | scape < 1.5.16 |
CRITICAL | 9.1 | The Scape - Multipurpose WordPress theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficien… | 1.5.16 | wordfence |
| WF-901e85b9 | 404-solution < 2.35.8 |
CRITICAL | 9.1 | The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.35.7 due to… | 2.35.8 | wordfence |
| WF-8ebb1072 | wp-staging < 3.5.0 |
CRITICAL | 9.1 | The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file… | 3.5.0 | wordfence |
| WF-8cf1889b | formgent | CRITICAL | 9.1 | The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress i… | — | wordfence |
| WF-8b7e1da1 | vikbooking < 1.8.11 |
CRITICAL | 9.1 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to arbitrary file deletion due to insuffici… | 1.8.11 | wordfence |
| WF-8b0f58b8 | woocommerce-multilingual < 5.3.4 |
CRITICAL | 9.1 | The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versio… | 5.3.4 | wordfence |
| WF-8aa0fffa | jwt-auth < 2.1.1 |
CRITICAL | 9.1 | In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) hea… | 2.1.1 | wordfence |
| WF-8a24e409 | pluginpass-pro-plugintheme-licensing | CRITICAL | 9.1 | The PluginPass – WordPress PRO Plugin/Theme Licensing (Public Alpha) plugin for WordPress is vulnerable to arbitrary f… | — | wordfence |
| WF-88b8a93b | spiffy-calendar < 4.9.12 |
CRITICAL | 9.1 | The Spiffy Calendar plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.9.11 due to … | 4.9.12 | wordfence |
| WF-885dd550 | wp-travel-pro | CRITICAL | 9.1 | The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-gui… | — | wordfence |
| WF-8834d017 | carzone | CRITICAL | 9.1 | The CarZone - A Complete Car Dealer HTML Wire-Frame theme for WordPress is vulnerable to arbitrary file deletion due to … | — | wordfence |
| WF-86d5af9f | woo-order-export-lite < 3.4.5 |
CRITICAL | 9.1 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up… | 3.4.5 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →