Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 362 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-640d36ac | myriad < 2.1 |
HIGH | 7.5 | The Myriad Theme for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.0. This is d… | 2.1 | wordfence |
| WF-6404476e | wp-ultimate-csv-importer < 7.9.9 |
HIGH | 7.5 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing… | 7.9.9 | wordfence |
| WF-63fa161b | two-factor < 0.17.0 |
HIGH | 7.5 | The Two Factor plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 0.16.0. Thi… | 0.17.0 | wordfence |
| WF-63ae3a9d | images-to-webp < 1.9 |
HIGH | 7.5 | The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the … | 1.9 | wordfence |
| WF-6351d3f7 | gd-rating-system < 2.3.1 |
HIGH | 7.5 | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the … | 2.3.1 | wordfence |
| WF-634f6c42 | schedule | HIGH | 7.5 | The Schedule plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.0 due to insuffic… | — | wordfence |
| WF-631c4d14 | lifterlms < 10.3.2 |
HIGH | 7.5 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclu… | 10.3.2 | wordfence |
| WF-62eb136f | contentstudio < 1.2.6 |
HIGH | 7.5 | The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including,… | 1.2.6 | wordfence |
| WF-62e223a5 | mapsvg-lite-interactive-vector-maps < 8.14.1 |
HIGH | 7.5 | The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to SQL Injection in versions up t… | 8.14.1 | wordfence |
| WF-62bb2fef | wp-upload-files-anywhere | HIGH | 7.5 | The WordPress Upload Files Anywhere plugin for WordPress is vulnerable to Path Traversal in all versions up to, and incl… | — | wordfence |
| WF-62b56147 | soledad | HIGH | 7.5 | The Soledad theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 8.7.0. This make… | — | wordfence |
| WF-62654952 | wilmer < 3.5 |
HIGH | 7.5 | The Wilmër theme for WordPress is vulnerable to Local File Inclusion in versions up to 3.5. This makes it possible for … | 3.5 | wordfence |
| WF-62022a7d | vikrentitems < 1.2.4 |
HIGH | 7.5 | The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to SQL Injection in all versions u… | 1.2.4 | wordfence |
| WF-61d065d0 | forminator < 1.58.0 |
HIGH | 7.5 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure… | 1.58.0 | wordfence |
| WF-6138f184 | automatorwp < 6.0.5 |
HIGH | 7.5 | The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vuln… | 6.0.5 | wordfence |
| WF-6122682d | boldermail | HIGH | 7.5 | The Boldermail plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.4.0 via de… | — | wordfence |
| WF-6113e51e | miniorange-oauth-20-server < 6.2.1 |
HIGH | 7.5 | The WP OAuth Server ( Login with WordPress ) plugin for WordPress is vulnerable to SQL Injection in versions up to, and … | 6.2.1 | wordfence |
| WF-60ed3820 | quiz-master-next < 11.2.8 |
HIGH | 7.5 | The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to PHP Object Injectio… | 11.2.8 | wordfence |
| WF-60e2f3d3 | wp-limit-failed-login-attempts < 5.6 |
HIGH | 7.5 | The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to SQL Injection in all versions up to, an… | 5.6 | wordfence |
| WF-60cd2178 | arielbrailovsky-viralad | HIGH | 7.5 | The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of th… | — | wordfence |
| WF-608d46e3 | woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers < 2.3.4 |
HIGH | 7.5 | The Fraud Prevention For WooCommerce and EDD plugin for WordPress is vulnerable to unauthorized access due to a missing … | 2.3.4 | wordfence |
| WF-607073ad | integrate-google-drive < 1.5.4 |
HIGH | 7.5 | The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensit… | 1.5.4 | wordfence |
| WF-603f0c9d | woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz | HIGH | 7.5 | The Kiwiz - Certification de facturation - Woocommerce plugin for WordPress is vulnerable to unauthenticated arbitrary f… | — | wordfence |
| WF-6038accc | outdoor | HIGH | 7.5 | The Outdoor plugin for WordPress is vulnerable to SQL Injection via the 'edit' action in all versions up to, and includi… | — | wordfence |
| WF-5fe86ce8 | easy-quotes < 1.2.3 |
HIGH | 7.5 | The Easy Quotes plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.2.2 due to insuf… | 1.2.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →