Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,429 vulnerabilities found (page 28 of 1858)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-cecffd72 | popup-builder < 3.45 |
CRITICAL | 9.8 | A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitat… | 3.45 | wordfence |
| WF-cece751c | ait-csv-import-export < 3.0.4 |
CRITICAL | 9.8 | The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… | 3.0.4 | wordfence |
| WF-ce8ec66f | mountdev-ai-mcp-connector < 1.6.2 |
CRITICAL | 9.8 | The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions u… | 1.6.2 | wordfence |
| WF-ce834ae1 | caldera-forms-pro < 1.7.7 |
CRITICAL | 9.8 | The Caldera Forms Pro plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on th… | 1.7.7 | wordfence |
| WF-ce544dd0 | pie-register < 3.1.2 |
CRITICAL | 9.8 | The Pie Register plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions before 3.1.2 d… | 3.1.2 | wordfence |
| WF-ce4c4395 | tutor < 2.7.1 |
CRITICAL | 9.8 | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due … | 2.7.1 | wordfence |
| WF-ce3ae202 | godam < 2.0.0 |
CRITICAL | 9.8 | The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin fo… | 2.0.0 | wordfence |
| WF-ce38401f | seofy-core < 1.6.11 |
CRITICAL | 9.8 | The Seofy Core plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.6.8. This … | 1.6.11 | wordfence |
| WF-ce332037 | capie < 1.0.53.1 |
CRITICAL | 9.8 | The Capie theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.40. This makes… | 1.0.53.1 | wordfence |
| WF-ce119965 | wp-travel-engine < 6.6.8 |
CRITICAL | 9.8 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File… | 6.6.8 | wordfence |
| WF-ce0dcbe6 | estatik < 4.1.1 |
CRITICAL | 9.8 | The Estatik Real Estate Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc… | 4.1.1 | wordfence |
| WF-cdbf2658 | super-socializer < 7.11 |
CRITICAL | 9.8 | The Social Share, Social Login and Social Comments plugin for WordPress is vulnerable to authorization bypass due to a m… | 7.11 | wordfence |
| WF-cdb35927 | wp-fundraising-donation < 1.5.0 |
CRITICAL | 9.8 | The WP Fundraising Donation and Crowdfunding Platform WordPress plugin through 1.4.2 does not sanitise and escape a para… | 1.5.0 | wordfence |
| WF-cd8a45c9 | gpt3-ai-content-generator < 1.8.90 |
CRITICAL | 9.8 | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val… | 1.8.90 | wordfence |
| WF-cd4f7b73 | yith-woocommerce-gift-cards-premium < 3.20.0 |
CRITICAL | 9.8 | The Yith WooCommerce Gift Cards Premium plugin for WordPress is vulnerable to arbitrary file uploads due to missing file… | 3.20.0 | wordfence |
| WF-cd3a7af1 | theplus_elementor_addon < 4.1.7 |
CRITICAL | 9.8 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious ac… | 4.1.7 | wordfence |
| WF-cd328738 | event-registration < 6.00.03 |
CRITICAL | 9.8 | SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to e… | 6.00.03 | wordfence |
| WF-cd28ac3c | export-wp-page-to-static-html < 5.0.0 |
CRITICAL | 9.8 | The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers… | 5.0.0 | wordfence |
| WF-cd00d716 | reveal-listing < 3.4 |
CRITICAL | 9.8 | The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and in… | 3.4 | wordfence |
| WF-cccbdb49 | cpl | CRITICAL | 9.8 | SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress … | — | wordfence |
| WF-cc748d31 | omni-secure-files < 0.1.14 |
CRITICAL | 9.8 | The Omni Secure Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation v… | 0.1.14 | wordfence |
| WF-cc742fa0 | newspaper < 6.7.2 |
CRITICAL | 9.8 | The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel. | 6.7.2 | wordfence |
| WF-cc550fd9 | my-geo-posts-free | CRITICAL | 9.8 | The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 v… | — | wordfence |
| WF-cc49112a | contact-form-7 < 6.2.4 |
CRITICAL | 9.8 | The Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload in versions 6.2 through 6.2.3. This is du… | 6.2.4 | wordfence |
| WF-cc2f8da1 | wc-designer-pro | CRITICAL | 9.8 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress the… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →