Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 199 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-5fca3dae | church-admin < 1.2550 |
HIGH | 8.8 | The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. | 1.2550 | wordfence |
| WF-5f8f8d46 | auto-refresh-single-page | HIGH | 8.8 | The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inclu… | — | wordfence |
| WF-5f42c8a0 | dc-woocommerce-multi-vendor < 3.8.12 |
HIGH | 8.8 | The Multivendor Marketplace Solution for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery i… | 3.8.12 | wordfence |
| WF-5f2fa602 | wp-maintenance < 5.0.6 |
HIGH | 8.8 | A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance… | 5.0.6 | wordfence |
| WF-5f2f34e1 | admin-custom-login < 2.4.8 |
HIGH | 8.8 | The Admin Custom Login plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting v… | 2.4.8 | wordfence |
| WF-5f24baee | wp-event-solution < 4.0.25 |
HIGH | 8.8 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File … | 4.0.25 | wordfence |
| WF-5ee1bc43 | mapsvg-lite-interactive-vector-maps < 8.6.5 |
HIGH | 8.8 | The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to arbitrary file uploads due to … | 8.6.5 | wordfence |
| WF-5eafb620 | integration-for-szamlazzhu-woocommerce < 5.6.3.3 |
HIGH | 8.8 | The Integration for Szamlazz.hu & WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio… | 5.6.3.3 | wordfence |
| WF-5eaac50c | ask-me < 6.8.4 |
HIGH | 8.8 | The Ask Me theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.8.3. This… | 6.8.4 | wordfence |
| WF-5ea53fb7 | complianz-gdpr < 6.3.4 |
HIGH | 8.8 | The Complianz plugin for WordPress is vulnerable to SQL Injection via unescaped translations in versions up to, and incl… | 6.3.4 | wordfence |
| WF-5ea53fb7 | complianz-gdpr-premium < 6.3.6 |
HIGH | 8.8 | The Complianz plugin for WordPress is vulnerable to SQL Injection via unescaped translations in versions up to, and incl… | 6.3.6 | wordfence |
| WF-5e8c06c7 | wp-ultimate-exporter < 1.4.2 |
HIGH | 8.8 | The Export WordPress Data with Advanced Filters plugin for WordPress is vulnerable to Cross-Site Request Forgery in vers… | 1.4.2 | wordfence |
| WF-5e78ec78 | photo-gallery < 1.2.42 |
HIGH | 8.8 | The Photo Gallery plugin before 1.2.42 for WordPress has CSRF. | 1.2.42 | wordfence |
| WF-5de8b93a | xforwoocommerce | HIGH | 8.8 | The XforWooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0… | — | wordfence |
| WF-5dce15ea | social-slider < 7.4.2 |
HIGH | 8.8 | SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows re… | 7.4.2 | wordfence |
| WF-5db5ea76 | popup-by-supsystic < 1.7.9 |
HIGH | 8.8 | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. | 1.7.9 | wordfence |
| WF-5db5c5e0 | ultimate-addons-for-contact-form-7 < 3.1.24 |
HIGH | 8.8 | The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ para… | 3.1.24 | wordfence |
| WF-5db42c7e | captainform | HIGH | 8.8 | The Forms by CaptainForm plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi… | — | wordfence |
| WF-5d82e9e2 | widget-logic-visual | HIGH | 8.8 | The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including… | — | wordfence |
| WF-5d7fb9fd | wonderplugin-audio < 2.1 |
HIGH | 8.8 | Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote… | 2.1 | wordfence |
| WF-5d762b22 | tracked-tweets | HIGH | 8.8 | The Tracked Tweets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.… | — | wordfence |
| WF-5d5d9ef7 | piwik-pro < 0.4.4 |
HIGH | 8.8 | Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer… | 0.4.4 | wordfence |
| WF-5d5d9ef7 | woopra < 1.4.3.2 |
HIGH | 8.8 | Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer… | 1.4.3.2 | wordfence |
| WF-5d4bd61c | adsense-deluxe | HIGH | 8.8 | Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress all… | — | wordfence |
| WF-5d2f07bb | woocommerce-abandon-cart-pro < 9.17.0 |
HIGH | 8.8 | The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missi… | 9.17.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →