Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 379 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-26613503 | colorit | HIGH | 7.5 | The ColorFolio theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3. This… | — | wordfence |
| WF-2611005b | techlife-cpt | HIGH | 7.5 | The Tech Life CPT plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 16.4 via … | — | wordfence |
| WF-25cb57fb | infocus < 3.4 |
HIGH | 7.5 | The inFocus Theme for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 3.3. This is … | 3.4 | wordfence |
| WF-25b93c52 | kittycatfish | HIGH | 7.5 | The KittyCatfish plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.2 due to insuff… | — | wordfence |
| WF-25a3ec45 | recover-wc-abandoned-cart | HIGH | 7.5 | The Recover abandoned cart for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and in… | — | wordfence |
| WF-258877a7 | school-management | HIGH | 7.5 | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via several parameters ac… | — | wordfence |
| WF-25128675 | scw-bus-seat-reservation | HIGH | 7.5 | The Bus Ticket Booking with Seat Reservation for WooCommerce plugin for WordPress is vulnerable to SQL Injection in vers… | — | wordfence |
| WF-250788a8 | contest-gallery-pro < 19.1.5 |
HIGH | 7.5 | The Contest Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 19.1.4.1 due t… | 19.1.5 | wordfence |
| WF-250788a8 | contest-gallery < 19.1.5 |
HIGH | 7.5 | The Contest Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 19.1.4.1 due t… | 19.1.5 | wordfence |
| WF-24f112eb | bit-integrations < 2.10.7 |
HIGH | 7.5 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vu… | 2.10.7 | wordfence |
| WF-24c78d62 | cp-image-store < 1.0.6 |
HIGH | 7.5 | The CP Image Store with Slideshow plugin for WordPress is vulnerable to Directory Traversal in versions before 1.0.6 via… | 1.0.6 | wordfence |
| WF-24c54ef5 | awesome-support < 6.3.2 |
HIGH | 7.5 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information … | 6.3.2 | wordfence |
| WF-24c2ae7d | gs-testimonial | HIGH | 7.5 | The Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews plugin for WordPress is vulnerable … | — | wordfence |
| WF-24b319e6 | history-collection | HIGH | 7.5 | The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter. | — | wordfence |
| WF-24902fab | ninja-forms < 3.14.1 |
HIGH | 7.5 | The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… | 3.14.1 | wordfence |
| WF-24890c27 | events-made-easy < 3.2.6 |
HIGH | 7.5 | The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.… | 3.2.6 | wordfence |
| WF-2480091f | infocus < 3.4 |
HIGH | 7.5 | The InFocus Theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 3.3. This is … | 3.4 | wordfence |
| WF-247b1921 | ai-copilot-content-generator < 1.4.19 |
HIGH | 7.5 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all… | 1.4.19 | wordfence |
| WF-245e9117 | integrar-getnet-con-woo < 0.0.5 |
HIGH | 7.5 | The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validati… | 0.0.5 | wordfence |
| WF-242b274d | nest-addons < 1.6.4 |
HIGH | 7.5 | The Nest Addons plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.6.3 due to insuf… | 1.6.4 | wordfence |
| WF-242819d5 | exhibz < 3.0.10 |
HIGH | 7.5 | The Exhibz theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.0.9. This makes… | 3.0.10 | wordfence |
| WF-24225f47 | user-activity-log | HIGH | 7.5 | The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed… | — | wordfence |
| WF-241d9cd3 | tainacan < 1.1.0 |
HIGH | 7.5 | The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all ve… | 1.1.0 | wordfence |
| WF-2403dd59 | ltl-freight-quotes-ups-edition < 3.6.5 |
HIGH | 7.5 | The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id'… | 3.6.5 | wordfence |
| WF-23bcd8b4 | different-shipping-and-billing-address-for-woocommerce < 1.5 |
HIGH | 7.5 | The Multiple Shipping And Billing Address For Woocommerce plugin for WordPress is vulnerable to SQL Injection in version… | 1.5 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →