Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1425 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-13c2b6d2 | nex-forms-express-wp-form-builder < 9.3.1 |
MEDIUM | 5.3 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Refer… | 9.3.1 | wordfence |
| WF-13a206ea | white-label-cms < 2.7.4 |
MEDIUM | 5.3 | The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability … | 2.7.4 | wordfence |
| WF-13981037 | wp-super-cache < 1.4.5 |
MEDIUM | 5.3 | The WP Super Cache plugin for WordPress is vulnerable to Directory Listing in versions up to, and including, 1.4.4. This… | 1.4.5 | wordfence |
| WF-138818d2 | wp-social-reviews < 3.20.2 |
MEDIUM | 5.3 | The WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets plugin for WordPress is vulnerable to unauthoriz… | 3.20.2 | wordfence |
| WF-1375c43c | disabler < 4.0.0 |
MEDIUM | 5.3 | The Disabler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.3. T… | 4.0.0 | wordfence |
| WF-136f9667 | sms-alert < 3.8.9 |
MEDIUM | 5.3 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a mis… | 3.8.9 | wordfence |
| WF-136ecfa1 | wpextended < 3.0.14 |
MEDIUM | 5.3 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of da… | 3.0.14 | wordfence |
| WF-13606d05 | wpf-add-on-by-click5 | MEDIUM | 5.3 | The click5 CRM add-on to WPForms plugin for WordPress is vulnerable to unauthorized access in all versions up to, and in… | — | wordfence |
| WF-135e55e0 | latepoint < 5.6.8 |
MEDIUM | 5.3 | The LatePoint plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 5.6.7. This is… | 5.6.8 | wordfence |
| WF-135c33bb | premium-addons-for-elementor < 4.11.54 |
MEDIUM | 5.3 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauth… | 4.11.54 | wordfence |
| WF-13396465 | contact-form-7-paypal-extension < 4.0.7 |
MEDIUM | 5.3 | The Accept PayPal Payments using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access in all version… | 4.0.7 | wordfence |
| WF-130c3bbf | mega_main_menu | MEDIUM | 5.3 | The Mega Main Menu plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including… | — | wordfence |
| WF-13088645 | ctt-expresso-para-woocommerce < 3.2.13 |
MEDIUM | 5.3 | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions u… | 3.2.13 | wordfence |
| WF-12f9464b | ai-image-alt-text-generator-for-wp < 1.1.6 |
MEDIUM | 5.3 | The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to unauthorized access due to a missing capabi… | 1.1.6 | wordfence |
| WF-12f7c109 | ghl-wizard < 2.1.2 |
MEDIUM | 5.3 | The Connector Wizard (formerly LC Wizard) plugin for WordPress is vulnerable to unauthorized access due to a missing cap… | 2.1.2 | wordfence |
| WF-12da87e1 | helpie-faq < 1.46 |
MEDIUM | 5.3 | The FAQ / Accordion / Docs / KB – Helpie WordPress FAQ Accordion plugin plugin for WordPress is vulnerable to Sensitiv… | 1.46 | wordfence |
| WF-12d465d2 | omnishop | MEDIUM | 5.3 | The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and includ… | — | wordfence |
| WF-12c9dc6c | salon-booking-system | MEDIUM | 5.3 | The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to un… | — | wordfence |
| WF-12bf1cd8 | wp-books-gallery < 4.8.1 |
MEDIUM | 5.3 | The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. … | 4.8.1 | wordfence |
| WF-12a296db | gravitysmtp < 2.1.5 |
MEDIUM | 5.3 | The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi… | 2.1.5 | wordfence |
| WF-12a12f2d | wp-event-solution < 4.1.26 |
MEDIUM | 5.3 | The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unau… | 4.1.26 | wordfence |
| WF-128c6ab5 | sharable-password-protected-posts < 1.1.1 |
MEDIUM | 5.3 | The Sharable Password Protected Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio… | 1.1.1 | wordfence |
| WF-12837ce3 | wp-security-audit-log < 3.1.2 |
MEDIUM | 5.3 | An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-securit… | 3.1.2 | wordfence |
| WF-12573522 | wp-user-manager < 2.10.5 |
MEDIUM | 5.3 | The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is v… | 2.10.5 | wordfence |
| WF-123ac22c | easy-form < 2.7.9 |
MEDIUM | 5.3 | The Easy Form plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function … | 2.7.9 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →