Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 355 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-7c69d0ec | simply-schedule-appointments < 1.6.9.29 |
HIGH | 7.5 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to S… | 1.6.9.29 | wordfence |
| WF-7bf3f882 | wp-maps < 4.9.7 |
HIGH | 7.5 | The Maps plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.9.6. This makes … | 4.9.7 | wordfence |
| WF-7bbead7c | contact-form-extender-for-divi-builder < 1.0.7 |
HIGH | 7.5 | The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insuffic… | 1.0.7 | wordfence |
| WF-7b73d309 | wp-db-backup < 2.3.0 |
HIGH | 7.5 | The wp-db-backup plugin up to 2.2.4 for WordPress relies on a five-character string for access control, which makes it e… | 2.3.0 | wordfence |
| WF-7b5ef9de | meta-box < 4.16.2 |
HIGH | 7.5 | The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. | 4.16.2 | wordfence |
| WF-7b4e9cf7 | cherryframework | HIGH | 7.5 | The Cherry Framework theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl… | — | wordfence |
| WF-7b0eff94 | latepoint < 5.6.4 |
HIGH | 7.5 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to… | 5.6.4 | wordfence |
| WF-7b00d175 | wp-headers-and-footers < 3.1.2 |
HIGH | 7.5 | The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a… | 3.1.2 | wordfence |
| WF-7af97962 | totalcontest-lite | HIGH | 7.5 | The Photo Contest | Competition | Video Contest plugin for WordPress is vulnerable to PHP Object Injection in versions … | — | wordfence |
| WF-7ab99751 | wp-letsencrypt-ssl < 7.1.0 |
HIGH | 7.5 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPre… | 7.1.0 | wordfence |
| WF-7a9cfd7a | recent-backups | HIGH | 7.5 | The Recent Backups plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.7 via t… | — | wordfence |
| WF-7a7677a4 | ocean-extra < 1.5.9 |
HIGH | 7.5 | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes … | 1.5.9 | wordfence |
| WF-7a5e08d8 | wp-user-manager < 2.9.18 |
HIGH | 7.5 | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in … | 2.9.18 | wordfence |
| WF-7a46c049 | wp-ultimate-csv-importer < 3.6.75 |
HIGH | 7.5 | The Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including… | 3.6.75 | wordfence |
| WF-7a1a46b3 | apptha-slider-gallery | HIGH | 7.5 | The Apptha Slider Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.5… | — | wordfence |
| WF-7a140b07 | gg-bought-together | HIGH | 7.5 | The GG Bought Together for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and includ… | — | wordfence |
| WF-7a0ed307 | smart-mag < 10.3.1 |
HIGH | 7.5 | The SmartMag theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.0. This ma… | 10.3.1 | wordfence |
| WF-79ffe548 | drag-and-drop-multiple-file-upload-contact-form-7 < 1.3.8.9 |
HIGH | 7.5 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in … | 1.3.8.9 | wordfence |
| WF-795002a5 | wp-multi-store-locator | HIGH | 7.5 | The WP Multistore Locator plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.5.2 du… | — | wordfence |
| WF-793e650c | mdc-youtube-downloader < 2.1.1 |
HIGH | 7.5 | Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers t… | 2.1.1 | wordfence |
| WF-793a2096 | alpack < 1.1.2 |
HIGH | 7.5 | The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_act… | 1.1.2 | wordfence |
| WF-7914ebe6 | uncode < 2.9.1.7 |
HIGH | 7.5 | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_… | 2.9.1.7 | wordfence |
| WF-790f93b0 | booking < 10.14.9 |
HIGH | 7.5 | The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' param… | 10.14.9 | wordfence |
| WF-7908d167 | another-wordpress-classifieds-plugin < 4.4.6.1 |
HIGH | 7.5 | The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versio… | 4.4.6.1 | wordfence |
| WF-78f964a7 | object-sync-for-salesforce | HIGH | 7.5 | The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type param… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →