Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1438 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-034246b2 | credova-financial < 1.4.9 |
MEDIUM | 5.3 | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaint… | 1.4.9 | wordfence |
| WF-033a7ca8 | image-sizes < 6.5 |
MEDIUM | 5.3 | The ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More p… | 6.5 | wordfence |
| WF-03288d4e | shared-files-pro < 1.7.70 |
MEDIUM | 5.3 | The Shared Files (free and pro) – File Upload & Download Manager plugin for WordPress is vulnerable to unauthorized ac… | 1.7.70 | wordfence |
| WF-03288d4e | shared-files < 1.7.67 |
MEDIUM | 5.3 | The Shared Files (free and pro) – File Upload & Download Manager plugin for WordPress is vulnerable to unauthorized ac… | 1.7.67 | wordfence |
| WF-0324b2d0 | wp-travel < 12.0.2 |
MEDIUM | 5.3 | The Travel plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 12.0.1. This … | 12.0.2 | wordfence |
| WF-0323b54b | wp-meta-seo < 4.5.13 |
MEDIUM | 5.3 | The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… | 4.5.13 | wordfence |
| WF-031df7ea | pochipp < 1.18.1 |
MEDIUM | 5.3 | The Pochipp plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in… | 1.18.1 | wordfence |
| WF-0312cea9 | booking-and-rental-manager-for-woocommerce < 2.3.9 |
MEDIUM | 5.3 | The Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress is vulnera… | 2.3.9 | wordfence |
| WF-030bb667 | eprolo-dropshipping | MEDIUM | 5.3 | The EPROLO-Dropshipping plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, … | — | wordfence |
| WF-02f4987d | woo-thank-you-page-nextmove-lite < 2.24.0 |
MEDIUM | 5.3 | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Refere… | 2.24.0 | wordfence |
| WF-02e0b218 | woo-payment-gateway-officeguy < 4.0.0 |
MEDIUM | 5.3 | The SUMIT Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, an… | 4.0.0 | wordfence |
| WF-02d994b7 | woo-aliexpress-dropshipping < 2.1.2 |
MEDIUM | 5.3 | The SharkDropship and Affiliate for AliExpress, eBay, Amazon, Etsy plugin for WordPress is vulnerable to unauthorized lo… | 2.1.2 | wordfence |
| WF-02d61a68 | cooked < 1.11.4 |
MEDIUM | 5.3 | The Cooked plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in … | 1.11.4 | wordfence |
| WF-02cb377a | bus-ticket-booking-with-seat-reservation < 5.9.4 |
MEDIUM | 5.3 | The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in a… | 5.9.4 | wordfence |
| WF-02c5e3ad | user-submitted-posts < 20260217 |
MEDIUM | 5.3 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incor… | 20260217 | wordfence |
| WF-02b0d7d7 | dokan-lite < 4.3.2 |
MEDIUM | 5.3 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Infor… | 4.3.2 | wordfence |
| WF-02af9eab | book-previewer-for-woocommerce | MEDIUM | 5.3 | The Book Previewer for Woocommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability… | — | wordfence |
| WF-02a2341b | asvereinbase < 1.1.8 |
MEDIUM | 5.3 | The asVereinbase plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and inclu… | 1.1.8 | wordfence |
| WF-029f6286 | wp-file-upload < 5.1.7 |
MEDIUM | 5.3 | The Iptanus File Upload plugin for WordPress is vulnerable to limited file overwrites in all versions up to, and includi… | 5.1.7 | wordfence |
| WF-029cf812 | auxin-elements | MEDIUM | 5.3 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Sensitive Information Exposure i… | — | wordfence |
| WF-029b4554 | udesign < 4.11.3 |
MEDIUM | 5.3 | The udesign theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in … | 4.11.3 | wordfence |
| WF-0274f1c0 | solace-extra < 1.7.0 |
MEDIUM | 5.3 | The Solace Extra plugin for WordPress is vulnerable to unauthorized access in all versions up to 1.7.0. This is due to m… | 1.7.0 | wordfence |
| WF-02487c67 | buddyforms | MEDIUM | 5.3 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (… | — | wordfence |
| WF-02461b79 | eventprime-event-calendar-management < 4.2.7.0 |
MEDIUM | 5.3 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access due t… | 4.2.7.0 | wordfence |
| WF-023bef79 | posti-shipping < 3.10.3 |
MEDIUM | 5.3 | The Posti Shipping plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.10… | 3.10.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →