Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1424 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-15909c21 | tutorstarter < 4.0.4 |
MEDIUM | 5.3 | The TutorStarter theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.0.3.… | 4.0.4 | wordfence |
| WF-157847ac | jet-booking < 4.1.2.1 |
MEDIUM | 5.3 | The JetBooking plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function… | 4.1.2.1 | wordfence |
| WF-156581cb | woodmart < 8.4.0 |
MEDIUM | 5.3 | The Woodmart theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8… | 8.4.0 | wordfence |
| WF-154fc656 | fluentform < 6.2.0 |
MEDIUM | 5.3 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vul… | 6.2.0 | wordfence |
| WF-153cb585 | drag-and-drop-multiple-file-upload-contact-form-7 < 1.3.7.8 |
MEDIUM | 5.3 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Ex… | 1.3.7.8 | wordfence |
| WF-15349295 | wp-ultimate-review < 2.3.0 |
MEDIUM | 5.3 | The Wp Ultimate Review plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability che… | 2.3.0 | wordfence |
| WF-152b63ce | user-registration < 5.3.0 |
MEDIUM | 5.3 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom… | 5.3.0 | wordfence |
| WF-1508ae48 | events-manager < 6.6.4.2 |
MEDIUM | 5.3 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to unauthorized access … | 6.6.4.2 | wordfence |
| WF-14fede14 | move-addons < 1.3.0 |
MEDIUM | 5.3 | The Move Addons for Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability chec… | 1.3.0 | wordfence |
| WF-14f665ba | norebro-extra | MEDIUM | 5.3 | The The Norebro Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… | — | wordfence |
| WF-14dcc17f | realty-workstation | MEDIUM | 5.3 | The Realty Workstation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a … | — | wordfence |
| WF-14d2198a | essential-real-estate < 5.3.5 |
MEDIUM | 5.3 | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on… | 5.3.5 | wordfence |
| WF-14b7fd1e | wordpress < 3.7.17 |
MEDIUM | 5.3 | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random nu… | 3.7.17 | wordfence |
| WF-14b6f5b6 | simple-ajax-chat < 20220216 |
MEDIUM | 5.3 | Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115 | 20220216 | wordfence |
| WF-149f5463 | press-permit-core < 4.8.4 |
MEDIUM | 5.3 | The PublishPress Permissions: Access Control, Content Permissions, User Access plugin for WordPress is vulnerable to Ins… | 4.8.4 | wordfence |
| WF-149ef56e | fusion-builder < 3.15.0 |
MEDIUM | 5.3 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check o… | 3.15.0 | wordfence |
| WF-14993c04 | restrict-for-elementor < 1.0.8 |
MEDIUM | 5.3 | The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a… | 1.0.8 | wordfence |
| WF-1497a6e4 | woo-paypal-gateway < 9.1.5 |
MEDIUM | 5.3 | The Payment Gateway for PayPal on WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing… | 9.1.5 | wordfence |
| WF-149428d3 | computer-repair-shop < 4.1236 |
MEDIUM | 5.3 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to unauthorized ac… | 4.1236 | wordfence |
| WF-147c8d60 | breeze < 2.2.22 |
MEDIUM | 5.3 | The Breeze Cache plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a functi… | 2.2.22 | wordfence |
| WF-141c33be | subscriptions-memberships-for-paypal < 1.1.8 |
MEDIUM | 5.3 | The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to unauthorized access due to a missing ca… | 1.1.8 | wordfence |
| WF-13fcfae2 | cmp-coming-soon-maintenance < 4.1.20 |
MEDIUM | 5.3 | The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to Maintenance Mode Bypas… | 4.1.20 | wordfence |
| WF-13fb7904 | loginpress-pro < 3.0 |
MEDIUM | 5.3 | The LoginPress Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c… | 3.0 | wordfence |
| WF-13cce634 | digital-download < 1.1.5 |
MEDIUM | 5.3 | The Digital Download theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a fun… | 1.1.5 | wordfence |
| WF-13c749cc | woocommerce-roles-permissions | MEDIUM | 5.3 | The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Informat… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →