Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1404 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-2f3fbff7 | payments-hubtel < 1.0.2 |
MEDIUM | 5.3 | The Payments for Hubtel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an… | 1.0.2 | wordfence |
| WF-2f32bf1e | payoneer-checkout < 3.5.0 |
MEDIUM | 5.3 | The Payoneer Checkout plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a f… | 3.5.0 | wordfence |
| WF-2f2ab0ba | sureforms < 2.11.1 |
MEDIUM | 5.3 | The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Paym… | 2.11.1 | wordfence |
| WF-2f262610 | wplegalpages < 3.7.1 |
MEDIUM | 5.3 | The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages … | 3.7.1 | wordfence |
| WF-2f12fa00 | campay-api < 1.2.3 |
MEDIUM | 5.3 | The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versi… | 1.2.3 | wordfence |
| WF-2f127fe5 | product-designer < 1.0.34 |
MEDIUM | 5.3 | The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o… | 1.0.34 | wordfence |
| WF-2eece6bd | snapshotify < 1.3.7 |
MEDIUM | 5.3 | The Snapshotify – All-in-One Backup & Restore & Migrate plugin for WordPress is vulnerable to Sensitive Information Ex… | 1.3.7 | wordfence |
| WF-2edbcf13 | better-chat-support < 1.2.19 |
MEDIUM | 5.3 | The Better Chat Support for Messenger plugin for WordPress is vulnerable to unauthorized access due to a missing capabil… | 1.2.19 | wordfence |
| WF-2ecec7d7 | royal-elementor-addons < 1.7.1057 |
MEDIUM | 5.3 | The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing … | 1.7.1057 | wordfence |
| WF-2eb5e5a9 | wp-ecommerce-paypal < 2.0.6 |
MEDIUM | 5.3 | The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Payment Manipulation in versions 1.8 throu… | 2.0.6 | wordfence |
| WF-2eae7c33 | sunshine-photo-cart < 3.0 |
MEDIUM | 5.3 | The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and in… | 3.0 | wordfence |
| WF-2ea91f5d | cost-calculator-builder < 4.0.18 |
MEDIUM | 5.3 | The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, … | 4.0.18 | wordfence |
| WF-2ea32997 | google-sitemap-generator < 4.1.23 |
MEDIUM | 5.3 | The Google XML Sitemaps plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a… | 4.1.23 | wordfence |
| WF-2e933356 | userswp < 1.2.48 |
MEDIUM | 5.3 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordP… | 1.2.48 | wordfence |
| WF-2e90f61b | easy-post-submission < 2.5.0 |
MEDIUM | 5.3 | The Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress plugin for WordPress is v… | 2.5.0 | wordfence |
| WF-2e69d666 | peepso-core < 6.4.6.1 |
MEDIUM | 5.3 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable t… | 6.4.6.1 | wordfence |
| WF-2e56e810 | tlp-food-menu < 6.0.2 |
MEDIUM | 5.3 | The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress is vulnerable to unauthorized a… | 6.0.2 | wordfence |
| WF-2e25557d | geodirectory < 2.8.169 |
MEDIUM | 5.3 | The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, … | 2.8.169 | wordfence |
| WF-2e249525 | cmp-coming-soon-maintenance < 4.1.21 |
MEDIUM | 5.3 | The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized access in… | 4.1.21 | wordfence |
| WF-2e093d1f | customer-reviews-woocommerce < 5.38.2 |
MEDIUM | 5.3 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi… | 5.38.2 | wordfence |
| WF-2df8570b | woo-bulk-editor < 1.1.4.4 |
MEDIUM | 5.3 | The BEAR plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th… | 1.1.4.4 | wordfence |
| WF-2dea1bcb | blog2social < 7.5.0 |
MEDIUM | 5.3 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure… | 7.5.0 | wordfence |
| WF-2de5868b | web-plura-backup-restore-manager | MEDIUM | 5.3 | The Web Plura Backup & Restore – Local Backups, Restore & Recovery plugin for WordPress is vulnerable to Sensitive Inf… | — | wordfence |
| WF-2dce3496 | invoicing < 2.8.63 |
MEDIUM | 5.3 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Improper Input … | 2.8.63 | wordfence |
| WF-2db29c12 | tickera-event-ticketing-system < 3.5.4.9 |
MEDIUM | 5.3 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up … | 3.5.4.9 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →