Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 149 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-cea39157 | crypto < 2.16 |
HIGH | 8.8 | The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This… | 2.16 | wordfence |
| WF-ce90db0c | baslider | HIGH | 8.8 | Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting… | — | wordfence |
| WF-ce779d08 | powerkit < 2.5.9 |
HIGH | 8.8 | The Powerkit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.8 Th… | 2.5.9 | wordfence |
| WF-ce5b3390 | duplicate-title-validate < 1.4 |
HIGH | 8.8 | The Duplicate Title Validate plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0 d… | 1.4 | wordfence |
| WF-ce3ff7f9 | auto-delete-posts | HIGH | 8.8 | The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which… | — | wordfence |
| WF-ce340b88 | all-in-one-wp-security-and-firewall < 5.1.1 |
HIGH | 8.8 | The All In One WP Security & Firewall plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to… | 5.1.1 | wordfence |
| WF-ce1ac711 | unlimited-elements-for-elementor < 1.5.67 |
HIGH | 8.8 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file upl… | 1.5.67 | wordfence |
| WF-cde6e758 | avada < 7.11.5 |
HIGH | 8.8 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due … | 7.11.5 | wordfence |
| WF-cdd7971c | mainwp-child-reports < 2.2.1 |
HIGH | 8.8 | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… | 2.2.1 | wordfence |
| WF-cd97a7a4 | simple-jwt-login < 3.6.7 |
HIGH | 8.8 | The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication B… | 3.6.7 | wordfence |
| WF-cd90d9c0 | vertical-marquee-plugin < 7.2 |
HIGH | 8.8 | The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, a… | 7.2 | wordfence |
| WF-cd7c763f | xcloner-backup-and-restore < 3.1.3 |
HIGH | 8.8 | cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary co… | 3.1.3 | wordfence |
| WF-cd4395be | seo-by-rank-math < 1.0.277 |
HIGH | 8.8 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection i… | 1.0.277 | wordfence |
| WF-cd393566 | full-customer < 3.1.26 |
HIGH | 8.8 | The FULL Customer plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.1.25. T… | 3.1.26 | wordfence |
| WF-cd36530d | whydowork-adsense | HIGH | 8.8 | Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker… | — | wordfence |
| WF-cd2b419f | qi-blocks < 1.3.3 |
HIGH | 8.8 | The Qi Blocks plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2. This m… | 1.3.3 | wordfence |
| WF-cd106b92 | pretix-widget < 1.0.6 |
HIGH | 8.8 | The pretix widget plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.5. Th… | 1.0.6 | wordfence |
| WF-cd091bd5 | acf-frontend-form-element < 3.29.3 |
HIGH | 8.8 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i… | 3.29.3 | wordfence |
| WF-ccc75dee | advanced-ajax-page-loader | HIGH | 8.8 | The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload … | — | wordfence |
| WF-ccad206a | twchat < 3.1.5 |
HIGH | 8.8 | The Two Way Chat plugin for WordPress is vulnerable to multiple Cross-Site Request Forgery in versions up to, and includ… | 3.1.5 | wordfence |
| WF-cc994b2a | themify-ultra < 7.3.6 |
HIGH | 8.8 | The themify-ultra theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.5.… | 7.3.6 | wordfence |
| WF-cc910c27 | fluid-responsive-slideshow < 2.2.7 |
HIGH | 8.8 | The Fluid Responsive Slideshow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i… | 2.2.7 | wordfence |
| WF-cc886378 | blobinator < 2.3 |
HIGH | 8.8 | The KONTXT Content Advisor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu… | 2.3 | wordfence |
| WF-cc7893ee | lifterlms < 10.3.0 |
HIGH | 8.8 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injec… | 10.3.0 | wordfence |
| WF-cc6d943d | easy-login-woocommerce < 2.3 |
HIGH | 8.8 | The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plug… | 2.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →