Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 145 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-d7b7b31a | hermit | HIGH | 8.8 | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugi… | — | wordfence |
| WF-d79dc179 | wp-masquerade | HIGH | 8.8 | The WP Masquerade plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.0… | — | wordfence |
| WF-d764b1be | private-files | HIGH | 8.8 | The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow a… | — | wordfence |
| WF-d74efb03 | export-import-menus < 1.9.0 |
HIGH | 8.8 | The Export Import Menus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation… | 1.9.0 | wordfence |
| WF-d726543c | vibebp < 1.9.9.8.2 |
HIGH | 8.8 | The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. T… | 1.9.9.8.2 | wordfence |
| WF-d7220537 | easy-paypal-donation < 1.3.1 |
HIGH | 8.8 | The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are … | 1.3.1 | wordfence |
| WF-d6fbf684 | sb-random-posts-widget < 1.1 |
HIGH | 8.8 | The SB Random Posts Widget plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, … | 1.1 | wordfence |
| WF-d6fb275b | cmp-coming-soon-maintenance < 4.1.17 |
HIGH | 8.8 | The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload … | 4.1.17 | wordfence |
| WF-d6dfed14 | wordpress < 4.6 |
HIGH | 8.8 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.… | 4.6 | wordfence |
| WF-d6d394af | xhanch-my-twitter < 2.7.7 |
HIGH | 8.8 | Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for … | 2.7.7 | wordfence |
| WF-d676700b | expire-users | HIGH | 8.8 | The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2.… | — | wordfence |
| WF-d6572568 | usc-e-shop < 2.8.4 |
HIGH | 8.8 | The Welcart e-Commerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including… | 2.8.4 | wordfence |
| WF-d6489214 | tutor < 1.8.3 |
HIGH | 8.8 | The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution W… | 1.8.3 | wordfence |
| WF-d6206d7e | simple-fields < 1.2 |
HIGH | 8.8 | The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface. | 1.2 | wordfence |
| WF-d60fb13c | flashnews-fading-effect-pearlbells | HIGH | 8.8 | The Flash News / Post (Responsive) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, a… | — | wordfence |
| WF-d60e1a2c | stats < 1.1.1 |
HIGH | 8.8 | The stats plugin for WordPress is vulnerable to SQL Injection via the $post_ids parameter in versions up to, and includi… | 1.1.1 | wordfence |
| WF-d60b5741 | ti-woocommerce-wishlist-premium < 1.21.5 |
HIGH | 8.8 | The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vu… | 1.21.5 | wordfence |
| WF-d60b5741 | ti-woocommerce-wishlist < 1.21.12 |
HIGH | 8.8 | The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vu… | 1.21.12 | wordfence |
| WF-d5b110a5 | woozone < 14.1.00 |
HIGH | 8.8 | The WooCommerce Amazon Affiliates - Wordpress Plugin plugin for WordPress is vulnerable to privilege escalation in all v… | 14.1.00 | wordfence |
| WF-d5a0c514 | backup-backup < 1.4.6.1 |
HIGH | 8.8 | The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.… | 1.4.6.1 | wordfence |
| WF-d598e3c7 | forminator < 1.56.0.1 |
HIGH | 8.8 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Privileg… | 1.56.0.1 | wordfence |
| WF-d560f28f | scrollto-bottom | HIGH | 8.8 | The ScrollTo Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in version… | — | wordfence |
| WF-d557db81 | testimonial-slider < 1.3.2 |
HIGH | 8.8 | The Testimonial Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including… | 1.3.2 | wordfence |
| WF-d539dc3f | gamipress < 7.3.8 |
HIGH | 8.8 | The GamiPress plugin for WordPress is vulnerable to Local File Inclusion via the gamipress_logs_shortcode() function in … | 7.3.8 | wordfence |
| WF-d52e644b | wp-update-mail-notification < 1.2.0 |
HIGH | 8.8 | The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lea… | 1.2.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →