Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 161 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-b1ecfa60 | contact-form-manager < 1.4.4 |
HIGH | 8.8 | A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by th… | 1.4.4 | wordfence |
| WF-b1e35b98 | hivepress < 1.8.0 |
HIGH | 8.8 | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Remote Code… | 1.8.0 | wordfence |
| WF-b1d7f2f5 | animated-number-counters < 2.2 |
HIGH | 8.8 | The Animated Number Counters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu… | 2.2 | wordfence |
| WF-b1bc4a87 | wp-editor < 1.2.9.3 |
HIGH | 8.8 | The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2… | 1.2.9.3 | wordfence |
| WF-b1a3666b | platform | HIGH | 8.8 | The Platform 4 theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. … | — | wordfence |
| WF-b191a337 | ask-me < 6.8.2 |
HIGH | 8.8 | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker t… | 6.8.2 | wordfence |
| WF-b1853c88 | lazy-blocks < 4.2.1 |
HIGH | 8.8 | The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up … | 4.2.1 | wordfence |
| WF-b17d1280 | onwebchat < 3.2.0 |
HIGH | 8.8 | Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote atta… | 3.2.0 | wordfence |
| WF-b155f8ca | unlimited-elements-for-elementor < 1.5.108 |
HIGH | 8.8 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injecti… | 1.5.108 | wordfence |
| WF-b150f90a | academy < 1.9.20 |
HIGH | 8.8 | The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege e… | 1.9.20 | wordfence |
| WF-b14bc75a | booking-system < 2.9.9.2.9 |
HIGH | 8.8 | The Pinpoint Booking System plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions u… | 2.9.9.2.9 | wordfence |
| WF-b142859d | dokan-lite < 5.0.3 |
HIGH | 8.8 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for Word… | 5.0.3 | wordfence |
| WF-b13e1916 | advanced-custom-fields < 5.12.5 |
HIGH | 8.8 | The Advanced Custom Fields plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, … | 5.12.5 | wordfence |
| WF-b12efe6c | spnbabble | HIGH | 8.8 | Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow… | — | wordfence |
| WF-b12a25e1 | sp-blog-designer | HIGH | 8.8 | The SP Blog Designer plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.0.… | — | wordfence |
| WF-b11ed628 | shopwarden < 1.0.12 |
HIGH | 8.8 | The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request F… | 1.0.12 | wordfence |
| WF-b10d8f8a | wp-recipe-maker < 9.2.0 |
HIGH | 8.8 | The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up t… | 9.2.0 | wordfence |
| WF-b0c646b7 | cds-simple-seo < 1.8.13 |
HIGH | 8.8 | The Simple SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.12… | 1.8.13 | wordfence |
| WF-b0907cb0 | miwoftp < 1.0.6 |
HIGH | 8.8 | The MiwoFTP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 1.0.6. This makes it pos… | 1.0.6 | wordfence |
| WF-b06ce1e4 | frontend-login-and-registration-blocks < 1.0.9 |
HIGH | 8.8 | The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeov… | 1.0.9 | wordfence |
| WF-b02ca3a1 | simple-301-redirects < 2.0.4 |
HIGH | 8.8 | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient n… | 2.0.4 | wordfence |
| WF-b01ee276 | zoho-salesiq < 1.0.9 |
HIGH | 8.8 | The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. | 1.0.9 | wordfence |
| WF-aff4d42c | custom-sidebars < 3.0.8.1 |
HIGH | 8.8 | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF. | 3.0.8.1 | wordfence |
| WF-afd7aeb7 | wp-dropzone < 1.1.1 |
HIGH | 8.8 | The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and inc… | 1.1.1 | wordfence |
| WF-afd4f2ca | homevillas-real-estate | HIGH | 8.8 | The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insuff… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →