Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 122 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-1dd3e203 | search-everything < 7.0.3 |
CRITICAL | 9.1 | SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remot… | 7.0.3 | wordfence |
| WF-1a53bcf5 | buddypress-xprofile-image-field | CRITICAL | 9.1 | The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to,… | — | wordfence |
| WF-19c4d9f5 | oxygen-mydata < 1.0.65 |
CRITICAL | 9.1 | The Oxygen MyData for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file… | 1.0.65 | wordfence |
| WF-1746da3b | image-export < 1.1.1 |
CRITICAL | 9.1 | Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and d… | 1.1.1 | wordfence |
| WF-16dca898 | gf-multi-uploader < 1.1.9 |
CRITICAL | 9.1 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all … | 1.1.9 | wordfence |
| WF-15f3a6e1 | atarim-visual-collaboration < 3.9.2 |
CRITICAL | 9.1 | The Atarim - Client Interface plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing c… | 3.9.2 | wordfence |
| WF-15880d3b | wprecovery | CRITICAL | 9.1 | The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, a… | — | wordfence |
| WF-15494ccf | easy-post-submission < 2.4.0 |
CRITICAL | 9.1 | The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… | 2.4.0 | wordfence |
| WF-14ff5609 | slider-by-supsystic < 1.8.11 |
CRITICAL | 9.1 | The Slider by Supsystic plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.8.10… | 1.8.11 | wordfence |
| WF-14877ff6 | image-resizer-on-the-fly | CRITICAL | 9.1 | The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… | — | wordfence |
| WF-13c03af2 | simple-photo-gallery | CRITICAL | 9.1 | The Simple Photo Gallery plugin for WordPress is vulnerable to generic SQL Injection via the ‘item’ parameter in ver… | — | wordfence |
| WF-13af3a6e | popup-builder < 4.4.6 |
CRITICAL | 9.1 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to … | 4.4.6 | wordfence |
| WF-12e2645c | real3d-flipbook | CRITICAL | 9.1 | The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion. | — | wordfence |
| WF-120e6a19 | advanced-xml-reader | CRITICAL | 9.1 | The Advanced XML Reader plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in versions up to, and… | — | wordfence |
| WF-0ee4fe34 | realia | CRITICAL | 9.1 | The Realia plugin for WordPress is vulnerable to Arbitrary Post Deletion in versions up to, and including, 1.4.0. This i… | — | wordfence |
| WF-0e656123 | database-toolset | CRITICAL | 9.1 | The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a funct… | — | wordfence |
| WF-0cee20a7 | membership-for-woocommerce < 3.1.1 |
CRITICAL | 9.1 | The Membership For WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file pa… | 3.1.1 | wordfence |
| WF-0af80be2 | article2pdf | CRITICAL | 9.1 | An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugi… | — | wordfence |
| WF-0a540897 | hdw-player-video-player-video-gallery < 3.0 |
CRITICAL | 9.1 | SQL injection vulnerability in the videos page in the HDW Player Plugin (hdw-player-video-player-video-gallery) 2.4.2 fo… | 3.0 | wordfence |
| WF-097a9d0f | formgent < 1.10.0 |
CRITICAL | 9.1 | The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability chec… | 1.10.0 | wordfence |
| WF-07fc1249 | wp-fastest-cache < 0.8.9.6 |
CRITICAL | 9.1 | The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversa… | 0.8.9.6 | wordfence |
| WF-072b66dd | wp-testimonial-widget | CRITICAL | 9.1 | The WP Testimonial Widget plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1 … | — | wordfence |
| WF-04bfad0d | portable-phpmyadmin | CRITICAL | 9.1 | WordPress Portable phpMyAdmin Plugin version 1.5.0 and below has an authentication bypass vulnerability. | — | wordfence |
| WF-0395b775 | gravityforms < 1.9.3.6 |
CRITICAL | 9.1 | The Gravifyforms plugin for WordPress is vulnerable to blind SQL Injection via the ‘sort_column GET’ parameter in ve… | 1.9.3.6 | wordfence |
| WF-02b24735 | auto-poster | CRITICAL | 9.1 | The Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all … | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →