Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 320 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-f2c20cde | modern-events-calendar-lite < 7.34.0 |
HIGH | 7.5 | The Modern Events Calendar (Lite & Pro) plugin for WordPress is vulnerable to SQL Injection in versions up to, and inclu… | 7.34.0 | wordfence |
| WF-f2891f3d | wc-product-table-lite < 4.6.3 |
HIGH | 7.5 | The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection v… | 4.6.3 | wordfence |
| WF-f26f1613 | wp-hrm-lite-human-resource-management-system | HIGH | 7.5 | The WP HRM LITE plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1 due to insuffi… | — | wordfence |
| WF-f24e753e | sell-downloads < 1.0.8 |
HIGH | 7.5 | The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase I… | 1.0.8 | wordfence |
| WF-f24db166 | dtracker | HIGH | 7.5 | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is autho… | — | wordfence |
| WF-f2401464 | ajax-load-more < 8.0.1 |
HIGH | 7.5 | The Ajax Load More plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 8.0.0 due to in… | 8.0.1 | wordfence |
| WF-f218f967 | church-management | HIGH | 7.5 | The WPCHURCH plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.0 due to insuffic… | — | wordfence |
| WF-f214b915 | sala | HIGH | 7.5 | The Sala theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.1.3 via deseriali… | — | wordfence |
| WF-f200062a | sctv-sales-countdown-timer | HIGH | 7.5 | The Sales Countdown Timer for WooCommerce and WordPress plugin for WordPress is vulnerable to Local File Inclusion in ve… | — | wordfence |
| WF-f185709e | contest-gallery-pro < 19.1.5 |
HIGH | 7.5 | The Contest Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 19.1.4.1 due t… | 19.1.5 | wordfence |
| WF-f185709e | contest-gallery < 19.1.5 |
HIGH | 7.5 | The Contest Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 19.1.4.1 due t… | 19.1.5 | wordfence |
| WF-f14a658c | file-manager-advanced < 5.2.11 |
HIGH | 7.5 | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… | 5.2.11 | wordfence |
| WF-f1117b57 | wpdirectorykit < 1.5.1 |
HIGH | 7.5 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.5.0 due to … | 1.5.1 | wordfence |
| WF-f10cf49b | jet-engine < 3.8.6.2 |
HIGH | 7.5 | The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all version… | 3.8.6.2 | wordfence |
| WF-f1060875 | echelon < 2.5 |
HIGH | 7.5 | The Echelon Theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.4. This is … | 2.5 | wordfence |
| WF-f0ff2cb3 | fushion-theme < 2.2 |
HIGH | 7.5 | The Fusion Theme for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.1. This is d… | 2.2 | wordfence |
| WF-f0e97124 | jet-engine < 3.8.4.1 |
HIGH | 7.5 | The JetEngine plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.8.4.1 (exclusive) via d… | 3.8.4.1 | wordfence |
| WF-f0de8ff3 | nextgen-gallery < 2.1.57 |
HIGH | 7.5 | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cs… | 2.1.57 | wordfence |
| WF-f0b9c46d | wp-dispatcher | HIGH | 7.5 | The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th… | — | wordfence |
| WF-f0ada9b6 | geodir_location_manager < 2.3.39 |
HIGH | 7.5 | The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API… | 2.3.39 | wordfence |
| WF-f0a5771b | mangboard < 2.0.0 |
HIGH | 7.5 | A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type paramete… | 2.0.0 | wordfence |
| WF-f0882205 | auxin-elements < 2.17.6 |
HIGH | 7.5 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all vers… | 2.17.6 | wordfence |
| WF-f07878bd | wp-file-upload < 5.1.8 |
HIGH | 7.5 | The File Upload plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.1.7 due to insuf… | 5.1.8 | wordfence |
| WF-f0328885 | kbase | HIGH | 7.5 | The Knowledge Base theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.9 via d… | — | wordfence |
| WF-f0235347 | small-package-quotes-wwe-edition < 5.2.19 |
HIGH | 7.5 | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit… | 5.2.19 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →