Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 345 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-9cecce4d | elegance-menu < 1.9.1 |
HIGH | 7.5 | The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 v… | 1.9.1 | wordfence |
| WF-9cec4d7a | wp-source-control < 3.1.1 |
HIGH | 7.5 | Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Sour… | 3.1.1 | wordfence |
| WF-9cbba523 | paid-downloads | HIGH | 7.5 | The Paid Downloads plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.15 due to ins… | — | wordfence |
| WF-9cb96b56 | theplus_elementor_addon < 5.0.7 |
HIGH | 7.5 | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_… | 5.0.7 | wordfence |
| WF-9c9ade2d | wpcues-basic-quiz | HIGH | 7.5 | The WpCues Basic Quiz plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.6.5. T… | — | wordfence |
| WF-9c92dbe9 | wp-job-portal < 2.3.3 |
HIGH | 7.5 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable … | 2.3.3 | wordfence |
| WF-9c8ab916 | shiftcontroller < 4.9.58 |
HIGH | 7.5 | The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrus… | 4.9.58 | wordfence |
| WF-9c2e8932 | wp-auctions | HIGH | 7.5 | The WordPress Auction Plugin plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3… | — | wordfence |
| WF-9c226d83 | dukapress < 2.5.4 |
HIGH | 7.5 | Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2… | 2.5.4 | wordfence |
| WF-9bfd6ec9 | responsive-posts-carousel-pro | HIGH | 7.5 | The Responsive Posts Carousel Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and incl… | — | wordfence |
| WF-9bf472f1 | groundhogg < 2.7.10 |
HIGH | 7.5 | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.… | 2.7.10 | wordfence |
| WF-9bd873e5 | quiz-maker < 21.8.0.100 |
HIGH | 7.5 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ par… | 21.8.0.100 | wordfence |
| WF-9bcd18bd | order-tip-woo < 1.5.5 |
HIGH | 7.5 | The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all ver… | 1.5.5 | wordfence |
| WF-9baea072 | miniorange-saml-20-single-sign-on < 5.4.7 |
HIGH | 7.5 | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and… | 5.4.7 | wordfence |
| WF-9b871957 | everest-backup < 2.2.14 |
HIGH | 7.5 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to… | 2.2.14 | wordfence |
| WF-9b1dc818 | better-wp-security < 6.9.1 |
HIGH | 7.5 | The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. | 6.9.1 | wordfence |
| WF-9b0f6653 | jquery-archive-list-widget < 6.2.0 |
HIGH | 7.5 | The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1… | 6.2.0 | wordfence |
| WF-9b0e973b | truebooker-appointment-booking < 1.2.3 |
HIGH | 7.5 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection … | 1.2.3 | wordfence |
| WF-9b0d1174 | noo-wemusic < 1.9.2 |
HIGH | 7.5 | The WeMusic theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.9.1 via deseri… | 1.9.2 | wordfence |
| WF-9b09bf42 | nextgen-gallery < 2.2.50 |
HIGH | 7.5 | In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. | 2.2.50 | wordfence |
| WF-9b00da60 | bit-integrations < 2.9.1 |
HIGH | 7.5 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vu… | 2.9.1 | wordfence |
| WF-9adbe55e | wild-apricot-login | HIGH | 7.5 | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Bindi… | — | wordfence |
| WF-9abfd0f5 | wpnakama < 0.6.4 |
HIGH | 7.5 | The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions… | 0.6.4 | wordfence |
| WF-9aad7539 | powerpress < 11.15.11 |
HIGH | 7.5 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to PHP Object Injection in all versions u… | 11.15.11 | wordfence |
| WF-9a7ad642 | wp-pipes | HIGH | 7.5 | The WP Pipes plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.3 due to insuffic… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →