Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 392 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-f8a653ab | stop-user-enumeration < 1.2.5 |
HIGH | 7.3 | The WordPress Stop User Enumeration Plugin for WordPress is vulnerable to Security Bypass in versions up to, and includi… | 1.2.5 | wordfence |
| WF-f8812cfe | wooshark-aliexpress-importer < 2.2.5 |
HIGH | 7.3 | The Sharkdropship for AliExpress Dropship and Affiliate plugin for WordPress is vulnerable to unauthorized access and mo… | 2.2.5 | wordfence |
| WF-f86a69ab | new-user-approve < 3.2.3 |
HIGH | 7.3 | The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a… | 3.2.3 | wordfence |
| WF-f771cf62 | ultimate-social-media-icons < 1.2.2 |
HIGH | 7.3 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress patched unspecified vulnerabilities in versio… | 1.2.2 | wordfence |
| WF-f75f83bf | directorypress < 3.6.3 |
HIGH | 7.3 | The DirectoryPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on severa… | 3.6.3 | wordfence |
| WF-f53e5192 | themeisle-companion < 2.6.4 |
HIGH | 7.3 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to authorization bypass due to missing capability checks o… | 2.6.4 | wordfence |
| WF-f3d597c3 | give < 4.16.8.1 |
HIGH | 7.3 | The GiveWP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.16.8.0. Th… | 4.16.8.1 | wordfence |
| WF-f3339f80 | acf-extended < 0.9.2.7 |
HIGH | 7.3 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.2.2 thro… | 0.9.2.7 | wordfence |
| WF-f23ff4ce | userswp-social-login < 1.5.10 |
HIGH | 7.3 | The UsersWP - Social Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includi… | 1.5.10 | wordfence |
| WF-f1ac2544 | enable-shortcodes-inside-widgetscomments-and-experts | HIGH | 7.3 | The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode … | — | wordfence |
| WF-f189f606 | uix-slideshow < 1.6.6 |
HIGH | 7.3 | The The Uix Slideshow plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… | 1.6.6 | wordfence |
| WF-ef1e656b | sms-alert < 4.0.3 |
HIGH | 7.3 | The SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery plugin for WordPress is vulne… | 4.0.3 | wordfence |
| WF-eebfa8de | wp-filebase < 0.2.9.25 |
HIGH | 7.3 | The WP-Filebase plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'del… | 0.2.9.25 | wordfence |
| WF-ecf803cf | profit-products-tables-for-woocommerce < 1.0.6.6 |
HIGH | 7.3 | The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to a… | 1.0.6.6 | wordfence |
| WF-ec425326 | woo-exfood < 3.3.3 |
HIGH | 7.3 | The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode executi… | 3.3.3 | wordfence |
| WF-eb81f83f | quiz-maker < 21.8.0.100 |
HIGH | 7.3 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in a… | 21.8.0.100 | wordfence |
| WF-eaf19371 | paid-member-subscriptions < 2.13.1 |
HIGH | 7.3 | The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for Wo… | 2.13.1 | wordfence |
| WF-ea136a60 | learnpress < 4.2.3.1 |
HIGH | 7.3 | The LearnPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability ch… | 4.2.3.1 | wordfence |
| WF-e9303719 | wooshark-woocommerce-dropshipping | HIGH | 7.3 | The Dropshipping and affiliates for Amazon and woocommerce plugin for WordPress is vulnerable to authorization bypass du… | — | wordfence |
| WF-e796b203 | portable-phpmyadmin < 1.3.1 |
HIGH | 7.3 | The Portable phpMyAdmin plugin before 1.3.0 for WordPress allows remote attackers to bypass authentication and obtain ph… | 1.3.1 | wordfence |
| WF-e5fe609a | woo-rede < 5.5.3 |
HIGH | 7.3 | The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Order Status Manipulation in all ve… | 5.5.3 | wordfence |
| WF-e4ecba83 | uncanny-learndash-toolkit < 3.8.3 |
HIGH | 7.3 | The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and … | 3.8.3 | wordfence |
| WF-e45afda4 | abcsubmit | HIGH | 7.3 | The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerab… | — | wordfence |
| WF-e353d938 | enqueue-anything | HIGH | 7.3 | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX… | — | wordfence |
| WF-e3499182 | civi | HIGH | 7.3 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →