Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1389 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-445b191c | timetics < 1.0.62 |
MEDIUM | 5.3 | The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to unauthorized access in … | 1.0.62 | wordfence |
| WF-444c181d | advanced-appointment-booking-scheduling < 2.7 |
MEDIUM | 5.3 | The Advanced Appointment Booking & Scheduling plugin for WordPress is vulnerable to unauthorized access in all versions … | 2.7 | wordfence |
| WF-4424b889 | alma-gateway-for-woocommerce < 5.16.2 |
MEDIUM | 5.3 | The Alma – Pay in installments or later for WooCommerce plugin for WordPress is vulnerable to unauthorized access due … | 5.16.2 | wordfence |
| WF-4420c334 | customer-reviews-woocommerce < 5.39.0 |
MEDIUM | 5.3 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi… | 5.39.0 | wordfence |
| WF-441a2519 | cubewp-framework < 1.1.28 |
MEDIUM | 5.3 | The CubeWP Framework plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a fu… | 1.1.28 | wordfence |
| WF-4419f975 | wp-fundraising-donation < 1.7.7 |
MEDIUM | 5.3 | The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to unauthorized access due to a… | 1.7.7 | wordfence |
| WF-440e2618 | backup-bolt < 1.4.0 |
MEDIUM | 5.3 | The Backup Bolt plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… | 1.4.0 | wordfence |
| WF-4402fb12 | audio-editor-recorder < 2.2.4 |
MEDIUM | 5.3 | The Audio Editor & Recorder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, … | 2.2.4 | wordfence |
| WF-43f38a87 | simple-download-monitor < 3.9.6 |
MEDIUM | 5.3 | The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any au… | 3.9.6 | wordfence |
| WF-43f34d3b | 12-step-meeting-list < 3.16.6 |
MEDIUM | 5.3 | The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… | 3.16.6 | wordfence |
| WF-43daaaf7 | woffice-core < 5.4.9 |
MEDIUM | 5.3 | The Woffice Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a functi… | 5.4.9 | wordfence |
| WF-43d8904f | wp-private-content-plus < 3.6.1 |
MEDIUM | 5.3 | The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and incl… | 3.6.1 | wordfence |
| WF-43d1264a | media-library-assistant < 3.30 |
MEDIUM | 5.3 | The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and includ… | 3.30 | wordfence |
| WF-43c781c3 | wordpress < 3.7.5 |
MEDIUM | 5.3 | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 all… | 3.7.5 | wordfence |
| WF-439ce99c | profitori | MEDIUM | 5.3 | The The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis plugin for Wo… | — | wordfence |
| WF-438dfea4 | event-tickets < 5.27.6.1 |
MEDIUM | 5.3 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability… | 5.27.6.1 | wordfence |
| WF-4360f293 | reuters-direct | MEDIUM | 5.3 | The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c… | — | wordfence |
| WF-4353192c | quick-paypal-payments < 6.0.4 |
MEDIUM | 5.3 | The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to unauthorized access in all versio… | 6.0.4 | wordfence |
| WF-435259dc | captcha-code-authentication < 3.33 |
MEDIUM | 5.3 | The Captcha Code plugin for WordPress is vulnerable to Bypass Vulnerability in all versions up to, and including, 3.32. … | 3.33 | wordfence |
| WF-432b72f3 | wp-posts-password-batch-manager | MEDIUM | 5.3 | The Posts Password Batch Manager plugin for WordPress is vulnerable to unauthorized access in all versions up to, and in… | — | wordfence |
| WF-432ac3b1 | elementskit-lite < 3.4.1 |
MEDIUM | 5.3 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… | 3.4.1 | wordfence |
| WF-4319fa2e | wp-members < 3.4.9.4 |
MEDIUM | 5.3 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i… | 3.4.9.4 | wordfence |
| WF-42dacd44 | change-wp-admin-login < 2.0.9 |
MEDIUM | 5.3 | The All In One Login — WP Admin Login Page Security and Customization with Google reCAPTCHA, Social Login, Limit Login… | 2.0.9 | wordfence |
| WF-42d4ec8b | wp-compress-image-optimizer < 7.22.38 |
MEDIUM | 5.3 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass … | 7.22.38 | wordfence |
| WF-42cd1b53 | wp-express-checkout < 2.3.8 |
MEDIUM | 5.3 | The WP Express Checkout (Accept PayPal Payments) plugin for WordPress is vulnerable to price manipulation in all version… | 2.3.8 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →