Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 126 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| CVE-2012-1823 KEV | php | CRITICAL | 9.0 | sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote… | — | cisa_kev |
| CVE-2012-0391 KEV | struts-2 | CRITICAL | 9.0 | The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability t… | — | cisa_kev |
| CVE-2009-1151 KEV | phpmyadmin | CRITICAL | 9.0 | Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in … | — | cisa_kev |
| CVE-2006-1547 KEV | struts-1 | CRITICAL | 9.0 | ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-… | — | cisa_kev |
| WF-c9d5c661 | affiliates-manager < 2.9.14 |
CRITICAL | 9.0 | The Affiliates Manager plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.9.13. Thi… | 2.9.14 | wordfence |
| WF-b8613acf | wp-all-export < 1.3.5 |
CRITICAL | 9.0 | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exp… | 1.3.5 | wordfence |
| WF-9d0c144b | bp-profile-search < 4.6 |
CRITICAL | 9.0 | The BP Profile Search plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.5.3… | 4.6 | wordfence |
| WF-79e2011c | nmedia-user-file-uploader < 18.3 |
CRITICAL | 9.0 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up… | 18.3 | wordfence |
| WF-6b2e210b | all-in-one-wp-security-and-firewall < 3.8.8 |
CRITICAL | 9.0 | SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote att… | 3.8.8 | wordfence |
| WF-5412fd87 | ads-by-datafeedrcom < 1.2.0 |
CRITICAL | 9.0 | The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1… | 1.2.0 | wordfence |
| WF-50e4e070 | wp-seopress < 7.9 |
CRITICAL | 9.0 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inclu… | 7.9 | wordfence |
| WF-4deb128d | bit-form < 2.13.10 |
CRITICAL | 9.0 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form buil… | 2.13.10 | wordfence |
| WF-4b159d4f | totop-link | CRITICAL | 9.0 | The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which … | — | wordfence |
| WF-12ea26be | simple-download-monitor < 3.9.5 |
CRITICAL | 9.0 | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputti… | 3.9.5 | wordfence |
| WF-fff8dfbc | woocommerce-products-filter < 1.3.5.3 |
HIGH | 8.8 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the '… | 1.3.5.3 | wordfence |
| WF-ffd6e18d | wp-product-feed-manager < 2.9.0 |
HIGH | 8.8 | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing cap… | 2.9.0 | wordfence |
| WF-ffd438ea | mapsvg < 8.6.13 |
HIGH | 8.8 | The MapSVG plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and excluding, 8.6.13. This… | 8.6.13 | wordfence |
| WF-ffcc85a1 | sola-newsletters | HIGH | 8.8 | The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function foun… | — | wordfence |
| WF-ffac779c | woocommerce-one-page-checkout < 2.4.0 |
HIGH | 8.8 | The WooCommerce One Page Checkout plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and incl… | 2.4.0 | wordfence |
| WF-ff9364a9 | demo-importer-plus < 2.0.9 |
HIGH | 8.8 | The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privil… | 2.0.9 | wordfence |
| WF-ff65e2cc | hospital-doctor-directory | HIGH | 8.8 | The Hospital Doctor Directory plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl… | — | wordfence |
| WF-ff29e160 | cm-pop-up-banners < 1.6.0 |
HIGH | 8.8 | The CM Pop-Up banners plugin for WordPress is vulnerable to generic SQL Injection via the getStatistics function in vers… | 1.6.0 | wordfence |
| WF-ff21e539 | gtranslate < 2.9.9 |
HIGH | 8.8 | The Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 WordPr… | 2.9.9 | wordfence |
| WF-ff21e539 | google-language-translator < 6.0.14 |
HIGH | 8.8 | The Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 WordPr… | 6.0.14 | wordfence |
| WF-ff09292b | wp-donimedia-carousel | HIGH | 8.8 | The WP donimedia carousel plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →