Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 125 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| CVE-2019-9978 KEV | social-warfare-plugin | CRITICAL | 9.0 | WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code executio… | — | cisa_kev |
| CVE-2019-9082 KEV | thinkphp | CRITICAL | 9.0 | ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/inv… | — | cisa_kev |
| CVE-2019-6340 KEV | core | CRITICAL | 9.0 | In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP cod… | — | cisa_kev |
| CVE-2019-17558 KEV | solr | CRITICAL | 9.0 | The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code exe… | — | cisa_kev |
| CVE-2019-11043 KEV | fastcgi-process-manager-fpm | CRITICAL | 9.0 | In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocat… | — | cisa_kev |
| CVE-2019-1003030 KEV | matrix-project-plugin | CRITICAL | 9.0 | Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity … | — | cisa_kev |
| CVE-2019-1003029 KEV | script-security-plugin | CRITICAL | 9.0 | Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox. | — | cisa_kev |
| CVE-2019-0211 KEV | http-server | CRITICAL | 9.0 | Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (inc… | — | cisa_kev |
| CVE-2019-0193 KEV | solr | CRITICAL | 9.0 | The optional Apache Solr module DataImportHandler contains a code injection vulnerability. | — | cisa_kev |
| CVE-2018-7602 KEV | core | CRITICAL | 9.0 | A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit mu… | — | cisa_kev |
| CVE-2018-7600 KEV | drupal-core | CRITICAL | 9.0 | Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vecto… | — | cisa_kev |
| CVE-2018-20062 KEV | nonecms | CRITICAL | 9.0 | ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of th… | — | cisa_kev |
| CVE-2018-11776 KEV | struts | CRITICAL | 9.0 | Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alw… | — | cisa_kev |
| CVE-2017-9841 KEV | phpunit | CRITICAL | 9.0 | PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as… | — | cisa_kev |
| CVE-2017-9805 KEV | struts | CRITICAL | 9.0 | Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filter… | — | cisa_kev |
| CVE-2017-9791 KEV | struts-1 | CRITICAL | 9.0 | The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw messa… | — | cisa_kev |
| CVE-2017-5638 KEV | struts | CRITICAL | 9.0 | Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote … | — | cisa_kev |
| CVE-2017-12617 KEV | tomcat | CRITICAL | 9.0 | When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP … | — | cisa_kev |
| CVE-2017-12615 KEV | tomcat | CRITICAL | 9.0 | When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a sp… | — | cisa_kev |
| CVE-2016-8735 KEV | tomcat | CRITICAL | 9.0 | Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener … | — | cisa_kev |
| CVE-2016-4437 KEV | shiro | CRITICAL | 9.0 | Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restric… | — | cisa_kev |
| CVE-2016-3088 KEV | activemq | CRITICAL | 9.0 | The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an H… | — | cisa_kev |
| CVE-2016-3081 KEV | struts | CRITICAL | 9.0 | Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via… | — | cisa_kev |
| CVE-2016-10033 KEV | phpmailer | CRITICAL | 9.0 | PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, thi… | — | cisa_kev |
| CVE-2013-2251 KEV | struts | CRITICAL | 9.0 | Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. | — | cisa_kev |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →