Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1363 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-69fe5af3 | payplug < 3.1.1 |
MEDIUM | 5.3 | The PayPlug for WooCommerce (Official) plugin for WordPress is vulnerable to unauthorized access in versions 2.8.0 throu… | 3.1.1 | wordfence |
| WF-69cb9ffe | user-registration < 5.2.6 |
MEDIUM | 5.3 | The User Registration & Membership plugin for WordPress is vulnerable to unauthorized access in versions up to, and incl… | 5.2.6 | wordfence |
| WF-69bdd5e6 | contus-video-comments | MEDIUM | 5.3 | The Contus Video Comments plugin for WordPress is vulnerable to authorization bypass due to a missing capability check o… | — | wordfence |
| WF-69bc3b17 | chained-quiz < 1.3.2.9 |
MEDIUM | 5.3 | The Chained Quiz plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the fina… | 1.3.2.9 | wordfence |
| WF-697a3f53 | product-loops | MEDIUM | 5.3 | The Product Loops for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability … | — | wordfence |
| WF-69692b0c | codemonkeys-hipaa-forms < 3.2.0 |
MEDIUM | 5.3 | The CM HIPAA Forms plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.1.0… | 3.2.0 | wordfence |
| WF-695df547 | contact-forms < 1.9.5 |
MEDIUM | 5.3 | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missin… | 1.9.5 | wordfence |
| WF-695cb611 | elegant-pink < 1.3.4 |
MEDIUM | 5.3 | The Elegant Pink theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a functio… | 1.3.4 | wordfence |
| WF-69527d4b | metform < 3.2.2 |
MEDIUM | 5.3 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and… | 3.2.2 | wordfence |
| WF-69347507 | user-registration < 5.2.3 |
MEDIUM | 5.3 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom… | 5.2.3 | wordfence |
| WF-69242be2 | ecab-taxi-booking-manager < 2.1.2 |
MEDIUM | 5.3 | The E-cab Taxi Booking Manager for Woocommerce plugin for WordPress is vulnerable to unauthorized access due to a missin… | 2.1.2 | wordfence |
| WF-69149cbc | front-end-only-users | MEDIUM | 5.3 | The Front End Users plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.2.… | — | wordfence |
| WF-690cc457 | memberpress < 1.11.35 |
MEDIUM | 5.3 | The Memberpress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a functio… | 1.11.35 | wordfence |
| WF-68f5ff96 | acf-frontend-form-element < 3.30.0 |
MEDIUM | 5.3 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized access in all versions up to, and in… | 3.30.0 | wordfence |
| WF-68f5bc13 | woocommerce-payments < 6.7.0 |
MEDIUM | 5.3 | The WooPayments – Fully Integrated Solution Built and Supported by Woo plugin for WordPress is vulnerable to Insecure … | 6.7.0 | wordfence |
| WF-68c4139b | invoicing < 2.8.55 |
MEDIUM | 5.3 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Payment Bypass … | 2.8.55 | wordfence |
| WF-68a509ae | wpforms-lite < 1.8.8.2 |
MEDIUM | 5.3 | The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manip… | 1.8.8.2 | wordfence |
| WF-6854e470 | magic-import-document-extractor < 1.0.6 |
MEDIUM | 5.3 | The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a mis… | 1.0.6 | wordfence |
| WF-684e6a97 | directorist < 8.3 |
MEDIUM | 5.3 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to… | 8.3 | wordfence |
| WF-6847da95 | pdf-generator-addon-for-elementor-page-builder < 2.0.1 |
MEDIUM | 5.3 | The PDF Generator for WordPress Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, an… | 2.0.1 | wordfence |
| WF-6844c9a6 | wp-user-frontend < 4.3.2 |
MEDIUM | 5.3 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP… | 4.3.2 | wordfence |
| WF-68375862 | picu < 2.4.1 |
MEDIUM | 5.3 | The picu – Online Photo Proofing Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a mi… | 2.4.1 | wordfence |
| WF-682e84f8 | wp-travel-engine < 6.8.2 |
MEDIUM | 5.3 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Payment By… | 6.8.2 | wordfence |
| WF-681fd20b | upload-fields-for-wpforms | MEDIUM | 5.3 | The Upload Fields for WPForms – Drag and Drop Multiple File Upload, Image Upload, and Google Drive Upload for WPForms … | — | wordfence |
| WF-681e91a8 | wc-peach-payments-gateway < 3.3.7 |
MEDIUM | 5.3 | The Peach Payments Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check o… | 3.3.7 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →