Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 197 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-63a4a077 | imgspider < 2.3.11 |
HIGH | 8.8 | The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'u… | 2.3.11 | wordfence |
| WF-6363b693 | infusedwoopro < 5.1.3 |
HIGH | 8.8 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.… | 5.1.3 | wordfence |
| WF-633d26e9 | wp-review-slider-pro < 12.7.0 |
HIGH | 8.8 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpf… | 12.7.0 | wordfence |
| WF-6324795d | wp-tripadvisor-review-slider < 10.8 |
HIGH | 8.8 | The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to SQL Injection via the $tid value in versions up t… | 10.8 | wordfence |
| WF-6320cd5f | minimal-coming-soon-maintenance-mode < 2.15 |
HIGH | 8.8 | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable main… | 2.15 | wordfence |
| WF-6319ef8c | debranding | HIGH | 8.8 | The de:branding plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.2. … | — | wordfence |
| WF-6305b7be | cardealer < 1.6.5 |
HIGH | 8.8 | The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. T… | 1.6.5 | wordfence |
| WF-62fd2c51 | schreikasten | HIGH | 8.8 | The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQ… | — | wordfence |
| WF-62ce7300 | wproject < 5.8.0 |
HIGH | 8.8 | The wproject theme for WordPress is vulnerable to Privilege Escalation in all versions up to 5.8.0 (exclusive). This mak… | 5.8.0 | wordfence |
| WF-629d4809 | hotel-listing < 1.3.7 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.3.7 | wordfence |
| WF-629d4809 | directory-pro < 1.9.5 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.9.5 | wordfence |
| WF-629d4809 | photographer-directory < 1.0.9 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.0.9 | wordfence |
| WF-629d4809 | lawyer-directory < 1.2.9 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.2.9 | wordfence |
| WF-629d4809 | real-estate-pro < 1.7.1 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.7.1 | wordfence |
| WF-629d4809 | institutions-directory < 1.3.1 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.3.1 | wordfence |
| WF-629d4809 | fitness-trainer < 1.4.1 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.4.1 | wordfence |
| WF-629d4809 | doctor-listing < 1.3.6 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.3.6 | wordfence |
| WF-629d4809 | wp-membership < 1.5.7 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.5.7 | wordfence |
| WF-629d4809 | producer-retailer | HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | — | wordfence |
| WF-629d4809 | final-user-wp-frontend-user-profiles < 1.2.2 |
HIGH | 8.8 | Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on sever… | 1.2.2 | wordfence |
| WF-6297753c | yotpo-reviews-for-woocommerce | HIGH | 8.8 | The Yotpo Reviews for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, an… | — | wordfence |
| WF-628eef73 | nmedia-user-file-uploader < 21.3 |
HIGH | 8.8 | The Frontend File Manager plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including,… | 21.3 | wordfence |
| WF-62831b8a | agile-store-locator < 1.4.6 |
HIGH | 8.8 | The Store Locator WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl… | 1.4.6 | wordfence |
| WF-6263e0cd | wp125 < 1.5.5 |
HIGH | 8.8 | The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, al… | 1.5.5 | wordfence |
| WF-624bdb9e | devvn-image-hotspot < 1.2.6 |
HIGH | 8.8 | The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includi… | 1.2.6 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →