Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1366 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-64ea54e2 | ameliabooking < 2.4.7 |
MEDIUM | 5.3 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access du… | 2.4.7 | wordfence |
| WF-64c2c8c2 | wp-club-manager < 2.2.11 |
MEDIUM | 5.3 | The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of … | 2.2.11 | wordfence |
| WF-64bc7d47 | google-listings-and-ads < 2.8.7 |
MEDIUM | 5.3 | The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and inclu… | 2.8.7 | wordfence |
| WF-649e12e7 | suredash < 1.12.3 |
MEDIUM | 5.3 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to unauthorized access in all … | 1.12.3 | wordfence |
| WF-64889659 | trinity-audio < 5.22.0 |
MEDIUM | 5.3 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to… | 5.22.0 | wordfence |
| WF-6483ba93 | cryptocurrency-donation-box | MEDIUM | 5.3 | The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to unauthorized access… | — | wordfence |
| WF-646e75be | woo-quick-view < 1.1.3 |
MEDIUM | 5.3 | The WooCommerce Quick View plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a… | 1.1.3 | wordfence |
| WF-646b853e | vitepos-lite < 3.1.5 |
MEDIUM | 5.3 | The Vitepos – Point of sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized access due… | 3.1.5 | wordfence |
| WF-646555e8 | mpcx-lightbox | MEDIUM | 5.3 | The MPCX Lightbox plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 1.2.2 through 1.2.5. … | — | wordfence |
| WF-645328f3 | wp-maintenance < 6.1.7 |
MEDIUM | 5.3 | The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.… | 6.1.7 | wordfence |
| WF-64373c83 | woo-gift-cards-lite < 3.2.10 |
MEDIUM | 5.3 | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to,… | 3.2.10 | wordfence |
| WF-64292fc7 | simply-schedule-appointments < 1.6.12.6 |
MEDIUM | 5.3 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up t… | 1.6.12.6 | wordfence |
| WF-63fd62b2 | wordpress < 2.1 |
MEDIUM | 5.3 | WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page para… | 2.1 | wordfence |
| WF-63fc381e | all-in-one-wp-security-and-firewall < 5.2.5 |
MEDIUM | 5.3 | The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to protection bypass on the … | 5.2.5 | wordfence |
| WF-63f98fd6 | pagerestrict | MEDIUM | 5.3 | The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5… | — | wordfence |
| WF-63c7bb29 | userfeedback-lite < 1.0.11 |
MEDIUM | 5.3 | The User Feedback plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization c… | 1.0.11 | wordfence |
| WF-63af850e | masterstudy-lms-learning-management-system < 3.7.46 |
MEDIUM | 5.3 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Sensitiv… | 3.7.46 | wordfence |
| WF-639bf20c | download-manager < 2.8.8 |
MEDIUM | 5.3 | The Download Manager plugin for WordPress is vulnerable to Directory Listing in versions up to, and including, 2.8.7. Th… | 2.8.8 | wordfence |
| WF-6387f210 | blockbooster < 1.0.11 |
MEDIUM | 5.3 | The Blockbooster theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec… | 1.0.11 | wordfence |
| WF-638217c4 | appointment-booking-calendar < 1.3.97 |
MEDIUM | 5.3 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and … | 1.3.97 | wordfence |
| WF-635c6343 | yith-woocommerce-product-bundles < 2.30.0 |
MEDIUM | 5.3 | The YITH WooCommerce Product Bundles plugin for WordPress is vulnerable to unauthorized access in all versions up to, an… | 2.30.0 | wordfence |
| WF-635787ad | miraculous < 2.1.2 |
MEDIUM | 5.3 | The Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme theme for WordPress is vulnerable to unauthor… | 2.1.2 | wordfence |
| WF-63530cc4 | security-ninja-premium < 5.290 |
MEDIUM | 5.3 | The security-ninja-premium plugin for WordPress is vulnerable to 2-Factor Authentication Bypass in all versions up to, a… | 5.290 | wordfence |
| WF-630d5dcc | woo-total-sales | MEDIUM | 5.3 | The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check … | — | wordfence |
| WF-6307864b | surferseo < 1.6.5.584 |
MEDIUM | 5.3 | The Surfer – WordPress Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability ch… | 1.6.5.584 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →