Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1370 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-60379757 | smtp-mail < 1.3.21 |
MEDIUM | 5.3 | The SMTP Mail plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3… | 1.3.21 | wordfence |
| WF-6030f7e5 | clear-sucuri-cache | MEDIUM | 5.3 | The Clear Sucuri Cache plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a … | — | wordfence |
| WF-602df370 | quiz-maker < 6.5.2.5 |
MEDIUM | 5.3 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… | 6.5.2.5 | wordfence |
| WF-60083262 | wpdirectorykit < 1.2.7 |
MEDIUM | 5.3 | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capabil… | 1.2.7 | wordfence |
| WF-5fcf9a7f | new-user-approve < 3.2.1 |
MEDIUM | 5.3 | The New User Approve plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a fu… | 3.2.1 | wordfence |
| WF-5fb338c2 | sunshine-photo-cart < 3.2.10 |
MEDIUM | 5.3 | The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on s… | 3.2.10 | wordfence |
| WF-5faa397f | jonradio-private-site < 4.2.3 |
MEDIUM | 5.3 | The My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam plugin for WordPress is vuln… | 4.2.3 | wordfence |
| WF-5fa75f3a | templately < 3.1.3 |
MEDIUM | 5.3 | The Templately – Elementor & Gutenberg Template Library: 5000+ Free & Pro Ready Templates & Cloud! plugin for WordPres… | 3.1.3 | wordfence |
| WF-5f9d237c | autoptimize < 3.1.0 |
MEDIUM | 5.3 | The Autoptimize plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3… | 3.1.0 | wordfence |
| WF-5f9cece7 | download-manager < 3.2.83 |
MEDIUM | 5.3 | The Download Manager plugin for WordPress is vulnerable to information Exposure in all versions up to, and including, 3.… | 3.2.83 | wordfence |
| WF-5f9301dc | bookit < 2.5.1 |
MEDIUM | 5.3 | The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of d… | 2.5.1 | wordfence |
| WF-5f902f32 | media-library-assistant < 3.30 |
MEDIUM | 5.3 | The Media Library Assistant plugin for WordPress is vulnerable to unauthorized access due to a missing capability check … | 3.30 | wordfence |
| WF-5f843d64 | responsive-google-map | MEDIUM | 5.3 | The Responsive Google Map plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on… | — | wordfence |
| WF-5f83c19e | wp-cafe < 2.2.24 |
MEDIUM | 5.3 | The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for Word… | 2.2.24 | wordfence |
| WF-5f7b9673 | simple-website-logo | MEDIUM | 5.3 | The Simple Website Logo plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a… | — | wordfence |
| WF-5f7143d7 | wp-event-manager < 3.4.2 |
MEDIUM | 5.3 | The Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 3.4.0 through 3.4.1… | 3.4.2 | wordfence |
| WF-5f70a523 | responsive-contact-form | MEDIUM | 5.3 | The Multi-language Responsive Contact Form plugin for WordPress is vulnerable to unauthorized access due to a missing ca… | — | wordfence |
| WF-5f6c0e18 | hydra-booking < 1.1.42 |
MEDIUM | 5.3 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized acces… | 1.1.42 | wordfence |
| WF-5f3c6d98 | wp-helper-lite < 4.6.2 |
MEDIUM | 5.3 | The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit… | 4.6.2 | wordfence |
| WF-5f388049 | iq-block-country < 1.2.17 |
MEDIUM | 5.3 | The iQ Block Country WordPress plugin through 1.2.13 does not properly checks HTTP headers in order to validate the orig… | 1.2.17 | wordfence |
| WF-5f24313e | rehub-theme < 19.9.8 |
MEDIUM | 5.3 | The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information … | 19.9.8 | wordfence |
| WF-5f1a861b | smart-wishlist-for-more-convert < 1.7.9 |
MEDIUM | 5.3 | The MC Woocommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap… | 1.7.9 | wordfence |
| WF-5f07558d | pymntpl-paypal-woocommerce < 2.0.20 |
MEDIUM | 5.3 | The Payment Plugins for PayPal WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, a… | 2.0.20 | wordfence |
| WF-5efe6f9b | wp-photo-album-plus < 9.2.07.002 |
MEDIUM | 5.3 | The Photo Album Plus plugin for WordPress is vulnerable to Arbitrary Zip File Deletion in versions up to, and including,… | 9.2.07.002 | wordfence |
| WF-5ed89df4 | document-gallery < 5.1.2 |
MEDIUM | 5.3 | The Document Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… | 5.1.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →