Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1415 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-220487de | woo-smart-quick-view < 4.2.6 |
MEDIUM | 5.3 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up t… | 4.2.6 | wordfence |
| WF-21f917a4 | atomchat < 1.1.5 |
MEDIUM | 5.3 | The AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… | 1.1.5 | wordfence |
| WF-21ede7f9 | mobile-events-manager | MEDIUM | 5.3 | Multiple plugins for WordPress are vulnerable to unauthorized access due to a missing capability check on a function in … | — | wordfence |
| WF-21ede7f9 | mobile-dj-manager < 1.7.8.5 |
MEDIUM | 5.3 | Multiple plugins for WordPress are vulnerable to unauthorized access due to a missing capability check on a function in … | 1.7.8.5 | wordfence |
| WF-21ec0fc9 | wp-cumulus < 1.23 |
MEDIUM | 5.3 | WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive informat… | 1.23 | wordfence |
| WF-21dcb733 | blocksy-companion-pro < 2.1.47 |
MEDIUM | 5.3 | The Blocksy Companion Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, … | 2.1.47 | wordfence |
| WF-21d79573 | ti-woocommerce-wishlist < 2.11.0 |
MEDIUM | 5.3 | The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized access due to a missing capability check … | 2.11.0 | wordfence |
| WF-21ccb2cc | syncee-global-dropshipping < 1.0.28 |
MEDIUM | 5.3 | The Syncee Premium Dropshipping & Wholesale plugin for WordPress is vulnerable to unauthorized access due to a missing c… | 1.0.28 | wordfence |
| WF-21b59c8c | ultimate-post < 5.0.4 |
MEDIUM | 5.3 | The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauth… | 5.0.4 | wordfence |
| WF-21a1a6c2 | ithemes-security-pro < 6.8.4 |
MEDIUM | 5.3 | It is possible to bypass the hidden login page functionality in iThemes Security < 7.9.1 and iThemes Security Pro < 6.8.… | 6.8.4 | wordfence |
| WF-21a1a6c2 | better-wp-security < 7.9.1 |
MEDIUM | 5.3 | It is possible to bypass the hidden login page functionality in iThemes Security < 7.9.1 and iThemes Security Pro < 6.8.… | 7.9.1 | wordfence |
| WF-218e68b5 | klarna-checkout-for-woocommerce < 2.13.5 |
MEDIUM | 5.3 | The Klarna Checkout for WooCommerce plugin for WordPress is vulnerable to Denial of Service in all versions up to, and i… | 2.13.5 | wordfence |
| WF-2175a181 | booktics < 1.0.29 |
MEDIUM | 5.3 | The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to unauthorized … | 1.0.29 | wordfence |
| WF-21690b9c | bookingpress-appointment-booking < 1.1.17 |
MEDIUM | 5.3 | The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL… | 1.1.17 | wordfence |
| WF-2163af55 | quttera-web-malware-scanner < 3.4.2.1 |
MEDIUM | 5.3 | The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up … | 3.4.2.1 | wordfence |
| WF-2162601a | all-contact-form-integration-for-elementor | MEDIUM | 5.3 | The EleForms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function i… | — | wordfence |
| WF-21618fba | profile-builder < 3.11.3 |
MEDIUM | 5.3 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is… | 3.11.3 | wordfence |
| WF-215ca15c | masterstudy-lms-learning-management-system < 3.7.50 |
MEDIUM | 5.3 | The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.7.… | 3.7.50 | wordfence |
| WF-21559bcf | directorist < 8.9.5 |
MEDIUM | 5.3 | The Directorist plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 8.1 through 8.9.4. This… | 8.9.5 | wordfence |
| WF-21552524 | leadconnector < 3.0.22 |
MEDIUM | 5.3 | The LeadConnector plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a funct… | 3.0.22 | wordfence |
| WF-2152b820 | gf-salesmate-add-on < 2.0.4 |
MEDIUM | 5.3 | The Salesmate Add-On for Gravity Forms plugin for WordPress is vulnerable to unauthorized access due to a missing capabi… | 2.0.4 | wordfence |
| WF-2116340a | wplegalpages < 3.5.2 |
MEDIUM | 5.3 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vul… | 3.5.2 | wordfence |
| WF-20f31e48 | fluentform < 5.0.9 |
MEDIUM | 5.3 | The Contact Form for Plugin by Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in ve… | 5.0.9 | wordfence |
| WF-20ecc8ea | securesubmit | MEDIUM | 5.3 | The WP SecureSubmit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl… | — | wordfence |
| WF-20e51573 | jetpack-feedback-exporter | MEDIUM | 5.3 | The Jetpack Feedback Exporter plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →