Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 33 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-c317fe6a | knr-author-list-widget < 3.0.0 |
CRITICAL | 9.8 | The Axact Author List Widget plugin for WordPress is vulnerable to generic SQL Injection via the ‘listItem’ paramete… | 3.0.0 | wordfence |
| WF-c309e32f | wp-job-portal < 2.3.2 |
CRITICAL | 9.8 | The WP Job Portal plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.3.1. Th… | 2.3.2 | wordfence |
| WF-c2c2385e | setsail-membership < 1.1 |
CRITICAL | 9.8 | The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due t… | 1.1 | wordfence |
| WF-c2c0ab2d | wux-blog-editor | CRITICAL | 9.8 | The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validatio… | — | wordfence |
| WF-c2b79193 | custom-registration-form-builder-with-submission-manager < 3.7.9.3 |
CRITICAL | 9.8 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is … | 3.7.9.3 | wordfence |
| WF-c2b2bb9a | woostagram-connect | CRITICAL | 9.8 | The Woostagram Connect plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including… | — | wordfence |
| WF-c2a6c3b7 | ai-copilot-content-generator < 1.4.19 |
CRITICAL | 9.8 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Privilege Escalation in all versions … | 1.4.19 | wordfence |
| WF-c28e2aba | product-designer < 1.0.33 |
CRITICAL | 9.8 | The Product Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.… | 1.0.33 | wordfence |
| WF-c274a9b2 | premium_gallery_manager | CRITICAL | 9.8 | The Premium Gallery Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type valida… | — | wordfence |
| WF-c2553c88 | qa-heatmap-analytics < 5.2.0.1 |
CRITICAL | 9.8 | The QA Assistants – Driven by data plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, … | 5.2.0.1 | wordfence |
| WF-c2475643 | ultimate_ai | CRITICAL | 9.8 | The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This… | — | wordfence |
| WF-c244eb33 | sv100-companion | CRITICAL | 9.8 | The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege e… | — | wordfence |
| WF-c23c3b24 | wp-fastest-cache < 0.8.4.9 |
CRITICAL | 9.8 | The WP Fastest Cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppoll… | 0.8.4.9 | wordfence |
| WF-c211e0c0 | wp-registration < 6.4 |
CRITICAL | 9.8 | The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and inclu… | 6.4 | wordfence |
| WF-c1fe4f60 | sf-booking < 6.1 |
CRITICAL | 9.8 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all … | 6.1 | wordfence |
| WF-c1f64b77 | wwc-amz-aff < 9.0.2.16 |
CRITICAL | 9.8 | The WooCommerce Amazon Affiliates plugin for WordPress is vulnerable to Arbitrary File Upload due to missing file type v… | 9.0.2.16 | wordfence |
| WF-c1e563e1 | easy-digital-downloads < 3.0.2 |
CRITICAL | 9.8 | The Easy Digital Downloads plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, … | 3.0.2 | wordfence |
| WF-c1d8ae51 | adserve < 0.3 |
CRITICAL | 9.8 | SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute ar… | 0.3 | wordfence |
| WF-c1d359ef | easy-invoice < 2.1.20 |
CRITICAL | 9.8 | The Easy Invoice – Invoice Generator, PDF Quotes & Payments plugin for WordPress is vulnerable to Remote Code Executio… | 2.1.20 | wordfence |
| WF-c1d354fc | wp-forum < 1.7.7 |
CRITICAL | 9.8 | SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL … | 1.7.7 | wordfence |
| WF-c1d02646 | rsvpmaker < 9.3.3 |
CRITICAL | 9.8 | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and param… | 9.3.3 | wordfence |
| WF-c1bb3ab9 | ajax-load-more < 2.11.2 |
CRITICAL | 9.8 | The Ajax Load More plugin for WordPress is vulnerable to Local File Inclusion in versions before 2.11.2 via the 'repeate… | 2.11.2 | wordfence |
| WF-c1b93229 | master-slider < 3.9.7 |
CRITICAL | 9.8 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions… | 3.9.7 | wordfence |
| WF-c1804afe | rbxgallery < 3.1 |
CRITICAL | 9.8 | Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin before 3.1 for WordPress allows remote … | 3.1 | wordfence |
| WF-c16fab08 | platform < 1.4.4 |
CRITICAL | 9.8 | The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalatio… | 1.4.4 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →