Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,429 vulnerabilities found (page 17 of 1858)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-eada519e | custom-searchable-data-entry-system | CRITICAL | 9.8 | The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress all… | — | wordfence |
| WF-ea9ee672 | dailydeal | CRITICAL | 9.8 | The Daily Deal theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the /… | — | wordfence |
| WF-ea9e5e5d | wp-directorybox-manager | CRITICAL | 9.8 | The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and inclu… | — | wordfence |
| WF-ea5f9fba | jiangqie-free-mini-program | CRITICAL | 9.8 | The JiangQie Free Mini Program plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val… | — | wordfence |
| WF-ea4c0ad7 | grandconference | CRITICAL | 9.8 | The Grand Conference plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 5.2 vi… | — | wordfence |
| WF-ea40d06e | file-manager-advanced-shortcode < 2.4 |
CRITICAL | 9.8 | The File Manager Advanced Shortcode WordPress plugin for WordPress is vulnerable to remote code execution in versions up… | 2.4 | wordfence |
| WF-ea3ba0f5 | elemin < 1.4.3 |
CRITICAL | 9.8 | Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-cont… | 1.4.3 | wordfence |
| WF-ea07c3c1 | system-report-and-phpinfo | CRITICAL | 9.8 | The Developer Tools plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.… | — | wordfence |
| WF-ea00bcc9 | wp-security-audit-log < 4.1.5 |
CRITICAL | 9.8 | The WP Activity Log plugin for WordPress is vulnerable to SQL Injection via multiple parameters in versions up to, and i… | 4.1.5 | wordfence |
| WF-e9fac523 | modal-survey | CRITICAL | 9.8 | The Modal Survey plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.2.0.1.… | — | wordfence |
| WF-e9ec79e5 | wordpress < 2.3.2 |
CRITICAL | 9.8 | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to b… | 2.3.2 | wordfence |
| WF-e9c81117 | social-share-buttons-by-supsystic < 2.2.7 |
CRITICAL | 9.8 | The Social Share Buttons by Supsystic plugin for WordPress is vulnerable to SQL Injection via the ‘value’ parameter … | 2.2.7 | wordfence |
| WF-e9c7fb16 | super-forms < 6.3.314 |
CRITICAL | 9.8 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions… | 6.3.314 | wordfence |
| WF-e993c929 | bricksforge < 3.1.8.10 |
CRITICAL | 9.8 | The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and inclu… | 3.1.8.10 | wordfence |
| WF-e988d042 | essential-addons-for-elementor-lite < 5.7.2 |
CRITICAL | 9.8 | The Essential Addons for Elementor plugin for WordPress is vulnerable to Unauthenticated Arbitrary Password Resets to Pr… | 5.7.2 | wordfence |
| WF-e95b2bfe | pods < 2.5.1.2 |
CRITICAL | 9.8 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ p… | 2.5.1.2 | wordfence |
| WF-e94f9cde | aawp < 3.12.3 |
CRITICAL | 9.8 | The Amazon Affiliate plugin for WordPress is vulnerable to Reflected File Download via image proxy in versions up to, an… | 3.12.3 | wordfence |
| WF-e93c8b3a | easy-login-woocommerce < 4.0.2 |
CRITICAL | 9.8 | The Login & Register Customizer – Forms, Popup, Profile & WooCommerce plugin for WordPress is vulnerable to privilege … | 4.0.2 | wordfence |
| WF-e920caeb | photoracer | CRITICAL | 9.8 | SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote atta… | — | wordfence |
| WF-e901c2a0 | updraftplus < 1.26.5 |
CRITICAL | 9.8 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all version… | 1.26.5 | wordfence |
| WF-e8c01984 | podlove-podcasting-plugin-for-wordpress < 3.5.6 |
CRITICAL | 9.8 | The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by def… | 3.5.6 | wordfence |
| WF-e8aa6ee7 | my-calendar < 3.4.25 |
CRITICAL | 9.8 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions … | 3.4.25 | wordfence |
| WF-e87d7ca0 | eptonic | CRITICAL | 9.8 | The Eptonic theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the VALUM… | — | wordfence |
| WF-e8574ff9 | adifier-system < 3.1.4 |
CRITICAL | 9.8 | The Adifier System theme for WordPress is vulnerable to Local File Inclusion in all versions up to 3.1.4 (exclusive). Th… | 3.1.4 | wordfence |
| WF-e8469ffc | rockhoist-ratings < 1.2.3 |
CRITICAL | 9.8 | The Rockhoist Ratings plugin for WordPress is vulnerable to generic SQL Injection via several parameters in versions up … | 1.2.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →