Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 139 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-e73fd28f | xsmart | HIGH | 8.8 | The xSmart - App Landing Page WordPress Theme in Tech Presentation, Promo Marketing & Advertising Agency theme for WordP… | — | wordfence |
| WF-e70e2b73 | estatik < 4.3.2 |
HIGH | 8.8 | The Estatik plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.3.1. This mak… | 4.3.2 | wordfence |
| WF-e703d411 | shortcodes-ultimate < 5.0.1 |
HIGH | 8.8 | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or use… | 5.0.1 | wordfence |
| WF-e702bb88 | idraw | HIGH | 8.8 | The I Draw plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versi… | — | wordfence |
| WF-e6e7889b | bulk-role-change | HIGH | 8.8 | The Bulk Change Role plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the… | — | wordfence |
| WF-e6e114a3 | server-status-by-hostnameip < 5.0 |
HIGH | 8.8 | A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an au… | 5.0 | wordfence |
| WF-e6ac52eb | rankology-seo-all-in-one-seo-analytics < 2.2.5 |
HIGH | 8.8 | The Rankology SEO – On-site SEO plugin for WordPress is vulnerable to unauthorized modification of data that can lead … | 2.2.5 | wordfence |
| WF-e647d1ff | classic-editor-addon < 2.6.4 |
HIGH | 8.8 | The Classic Editor Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi… | 2.6.4 | wordfence |
| WF-e62ad97d | kids-gift-shop < 0.5.5 |
HIGH | 8.8 | The Kids Gift Shop theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in al… | 0.5.5 | wordfence |
| WF-e620328e | wordpress < 3.7.17 |
HIGH | 8.8 | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authenti… | 3.7.17 | wordfence |
| WF-e61f1835 | homepage-pop-up | HIGH | 8.8 | The Homepage PopUp plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.… | — | wordfence |
| WF-e61396d0 | post-smtp < 3.3.0 |
HIGH | 8.8 | The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Br… | 3.3.0 | wordfence |
| WF-e5ce4685 | searchgo < 2.8.1 |
HIGH | 8.8 | The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up… | 2.8.1 | wordfence |
| WF-e5ca3c84 | widget-google-reviews < 2.2.3 |
HIGH | 8.8 | The Plugin for Google Reviews for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including… | 2.2.3 | wordfence |
| WF-e5b01e96 | wp-event-solution < 4.0.9 |
HIGH | 8.8 | The Eventin plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.7. This mak… | 4.0.9 | wordfence |
| WF-e5aa9b71 | acf-frontend-form-element < 3.29.10 |
HIGH | 8.8 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i… | 3.29.10 | wordfence |
| WF-e597b677 | spider-event-calendar < 1.4.14 |
HIGH | 8.8 | The SpiderCalendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.… | 1.4.14 | wordfence |
| WF-e579b7fd | clickbank-ads-clickbank-widget < 1.31 |
HIGH | 8.8 | The ClickBank Affiliate Ads WordPress plugin before 1.31 does not have CSRF check when saving its settings, allowing att… | 1.31 | wordfence |
| WF-e55b86e2 | nd-elements < 2.2 |
HIGH | 8.8 | The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… | 2.2 | wordfence |
| WF-e556d8c9 | ultimate-member < 2.0.40 |
HIGH | 8.8 | An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.0.39 for WordPress. It is possible (due… | 2.0.40 | wordfence |
| WF-e54f98bc | wpschoolpress < 2.2.17 |
HIGH | 8.8 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missi… | 2.2.17 | wordfence |
| WF-e53bb240 | simple-membership < 4.3.5 |
HIGH | 8.8 | The Simple Membership plugin for WordPress is vulnerable to account takeover due to missing input validation on the proc… | 4.3.5 | wordfence |
| WF-e52c95b3 | widget-wrangler | HIGH | 8.8 | The Widget Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.… | — | wordfence |
| WF-e5240171 | testimonial-slider < 1.2.5 |
HIGH | 8.8 | The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id … | 1.2.5 | wordfence |
| WF-e4e6e410 | media-file-manager-advanced | HIGH | 8.8 | The Media File Manager Advanced plugin for WordPress is vulnerable to Local File Disclosure, SQL Injection, Cross-Site S… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →