Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1472 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-b3ea5e75 | thinkit-wp-contact-form < 0.3 |
MEDIUM | 4.7 | The ThinkIT WP Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 0.3. Thi… | 0.3 | wordfence |
| WF-b1791d41 | paid-memberships-pro < 2.3.3 |
MEDIUM | 4.7 | SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to… | 2.3.3 | wordfence |
| WF-b15b08e1 | wp-edit-password-protected < 1.3.5 |
MEDIUM | 4.7 | The Wp Edit Password Protected – Create Password Protect Pages & Design Password Protected Form plugin for WordPress i… | 1.3.5 | wordfence |
| WF-b0ab311f | fl3r-feelbox | MEDIUM | 4.7 | The FL3R FeelBox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.1.… | — | wordfence |
| WF-ae13e0eb | responsive-filterable-portfolio < 1.0.23 |
MEDIUM | 4.7 | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up… | 1.0.23 | wordfence |
| WF-abe6366a | instagram-feed < 6.11.2 |
MEDIUM | 4.7 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Reques… | 6.11.2 | wordfence |
| WF-ab6b9d89 | ewww-image-optimizer < 8.8.0 |
MEDIUM | 4.7 | The EWWW Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and includ… | 8.8.0 | wordfence |
| WF-ab4175d7 | sureforms < 2.13.0 |
MEDIUM | 4.7 | The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to HTML… | 2.13.0 | wordfence |
| WF-a2e493cf | wordpress-database-reset < 3.23 |
MEDIUM | 4.7 | The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… | 3.23 | wordfence |
| WF-a224e745 | woocommerce-product-vendors < 2.0.36 |
MEDIUM | 4.7 | The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions u… | 2.0.36 | wordfence |
| WF-a092266b | responsive-column-widgets | MEDIUM | 4.7 | The Responsive Column Widgets plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.2.… | — | wordfence |
| WF-a06bba7f | imagerecycle-pdf-image-compression < 3.1.15 |
MEDIUM | 4.7 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version… | 3.1.15 | wordfence |
| WF-9d69213f | backup-backup < 2.1.7 |
MEDIUM | 4.7 | The Backup Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.… | 2.1.7 | wordfence |
| WF-9bb026a4 | the-events-calendar < 4.1.1.1 |
MEDIUM | 4.7 | The Events Calendar plugin for WordPress is vulnerable to an open redirect vulnerability in versions before 4.1.1.1. Thi… | 4.1.1.1 | wordfence |
| WF-9963e0f8 | open-user-map-pro < 1.4.32 |
MEDIUM | 4.7 | The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notificati… | 1.4.32 | wordfence |
| WF-97c68df7 | woo-product-enquiry < 2.7.0 |
MEDIUM | 4.7 | The WooCommerce Product Enquiry plugin for WordPress is vulnerable to Self-Cross-Site Scripting via the enquiry form fie… | 2.7.0 | wordfence |
| WF-95d68a5d | wp-automatic < 3.119.0 |
MEDIUM | 4.7 | The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a… | 3.119.0 | wordfence |
| WF-95d4fbf6 | woo-parcel-pro < 1.6.12 |
MEDIUM | 4.7 | The Parcel Pro plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.6.11. This is… | 1.6.12 | wordfence |
| WF-938e8f54 | flash-player-widget | MEDIUM | 4.7 | The Flash player widget plugin for WordPress is vulnerable to Content Spoofing in versions up to, and including, 1.3. Th… | — | wordfence |
| WF-92928f3b | wp-staging < 3.5.0 |
MEDIUM | 4.7 | The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to Server-Side Re… | 3.5.0 | wordfence |
| WF-90e462ef | post-duplicator < 3.0.18 |
MEDIUM | 4.7 | The Post Duplicator plugin for WordPress is vulnerable to Privilege Escalation in all versions up to 3.0.18. This is due… | 3.0.18 | wordfence |
| WF-8db736fb | wpdatatables < 6.5.0.5 |
MEDIUM | 4.7 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to St… | 6.5.0.5 | wordfence |
| WF-8a6ca886 | simple-membership < 4.4.3 |
MEDIUM | 4.7 | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter… | 4.4.3 | wordfence |
| WF-863c29b7 | wp-import-export-lite < 3.9.35 |
MEDIUM | 4.7 | The Import Export Lite plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, … | 3.9.35 | wordfence |
| WF-81f9a4c6 | order-tracking < 3.3.7 |
MEDIUM | 4.7 | The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter … | 3.3.7 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →