Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1447 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-bcae549f | sms-alert < 3.9.8 |
MEDIUM | 4.9 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulne… | 3.9.8 | wordfence |
| WF-bc176920 | zoho-flow < 2.8.1 |
MEDIUM | 4.9 | The Zoho Flow for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.8.0… | 2.8.1 | wordfence |
| WF-bbe9eed9 | wordpress < 3.7.22 |
MEDIUM | 4.9 | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme fil… | 3.7.22 | wordfence |
| WF-bb9aedc6 | complianz-gdpr < 7.4.5 |
MEDIUM | 4.9 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers… | 7.4.5 | wordfence |
| WF-bb8f7748 | woo-advanced-shipment-tracking < 4.0.1 |
MEDIUM | 4.9 | The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, an… | 4.0.1 | wordfence |
| WF-bb3859eb | string-locator < 2.5.0 |
MEDIUM | 4.9 | The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowi… | 2.5.0 | wordfence |
| WF-bb23bc2e | booking-system < 2.9.9.7.0 |
MEDIUM | 4.9 | The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' para… | 2.9.9.7.0 | wordfence |
| WF-ba60fb73 | photo-gallery < 1.5.25 |
MEDIUM | 4.9 | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversa… | 1.5.25 | wordfence |
| WF-ba326241 | user-registration < 4.4.0 |
MEDIUM | 4.9 | The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version … | 4.4.0 | wordfence |
| WF-ba0de040 | font < 7.5.1 |
MEDIUM | 4.9 | Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administra… | 7.5.1 | wordfence |
| WF-b972626c | database-backup < 2.33 |
MEDIUM | 4.9 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Trave… | 2.33 | wordfence |
| WF-b95af878 | askeet < 3.1 |
MEDIUM | 4.9 | The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (a… | 3.1 | wordfence |
| WF-b8440c1d | sms-alert < 3.9.8 |
MEDIUM | 4.9 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulne… | 3.9.8 | wordfence |
| WF-b82a0f71 | simple-download-counter < 2.2.3 |
MEDIUM | 4.9 | The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2… | 2.2.3 | wordfence |
| WF-b809d705 | wp-sms < 7.0 |
MEDIUM | 4.9 | The SMS plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.9.12 due to insufficient… | 7.0 | wordfence |
| WF-b7850e73 | form-maker < 1.15.44 |
MEDIUM | 4.9 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to gener… | 1.15.44 | wordfence |
| WF-b68a067f | aco-product-labels-for-woocommerce < 1.5.11 |
MEDIUM | 4.9 | The Product Labels For Woocommerce (Sale Badges) plugin for WordPress is vulnerable to SQL Injection in all versions up … | 1.5.11 | wordfence |
| WF-b6675c48 | fluentforms-pdf < 1.1.8 |
MEDIUM | 4.9 | The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site S… | 1.1.8 | wordfence |
| WF-b6364415 | simple-history < 5.8.2 |
MEDIUM | 4.9 | The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sani… | 5.8.2 | wordfence |
| WF-b5635423 | ip-blacklist-cloud < 3.43 |
MEDIUM | 4.9 | The IP Blacklist Cloud plugin for WordPress is vulnerable to Directory Traversal in versions before 3.43 via the importC… | 3.43 | wordfence |
| WF-b5582e89 | wordpress < 3.7.39 |
MEDIUM | 4.9 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploite… | 3.7.39 | wordfence |
| WF-b43ab8c8 | wp-import-export-lite < 3.9.33 |
MEDIUM | 4.9 | The Import Export Lite plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.9.32.… | 3.9.33 | wordfence |
| WF-b3fd57f3 | infocob-crm-forms < 2.4.1 |
MEDIUM | 4.9 | The Infocob CRM Forms plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.4.0. … | 2.4.1 | wordfence |
| WF-b3a58e68 | ameliabooking < 2.4.4 |
MEDIUM | 4.9 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the … | 2.4.4 | wordfence |
| WF-b3a4ff32 | woocommerce-multilingual < 5.5.8 |
MEDIUM | 4.9 | The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versio… | 5.5.8 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →