Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 398 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-7addc83b | jet-tabs < 2.1.25.2 |
HIGH | 7.3 | Multiple plugins by Crocoblock for WordPress are vulnerable to unauthorized access due to a missing capability check on … | 2.1.25.2 | wordfence |
| WF-76fe8746 | timetics < 1.0.22 |
HIGH | 7.3 | The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress… | 1.0.22 | wordfence |
| WF-75e9a90d | newsletters-lite < 4.16 |
HIGH | 7.3 | The Newsletters plugin for WordPress is vulnerable to unauthorized access due to an insufficient authorization check on … | 4.16 | wordfence |
| WF-75a00c52 | paymentfor-gateway-for-woocommerce < 1.0.6 |
HIGH | 7.3 | The Paymentfor Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Origin Verification in all versions… | 1.0.6 | wordfence |
| WF-74841c33 | floating-action-button < 1.2.1 |
HIGH | 7.3 | The Floating Action Button plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, … | 1.2.1 | wordfence |
| WF-71d63f0d | mainwp < 2.0.23 |
HIGH | 7.3 | Unspecified vulnerability in the MainWP Dashboard and MainWP Child plugins in versions up to and including 2.0.22 for Wo… | 2.0.23 | wordfence |
| WF-71d63f0d | mainwp-child < 2.0.23 |
HIGH | 7.3 | Unspecified vulnerability in the MainWP Dashboard and MainWP Child plugins in versions up to and including 2.0.22 for Wo… | 2.0.23 | wordfence |
| WF-70f2c885 | connections < 9.7 |
HIGH | 7.3 | The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, w… | 9.7 | wordfence |
| WF-70235939 | headless-single-sign-on < 1.7.1 |
HIGH | 7.3 | The Headless SSO Plugin for WP plugin for WordPress is vulnerable to Account Takeover in all versions up to, and includi… | 1.7.1 | wordfence |
| WF-6fe8b2c8 | integrate-google-drive < 1.2.0 |
HIGH | 7.3 | The Integrate Google Drive plugin for WordPress is vulnerable to unauthorized access due to a missing capability check o… | 1.2.0 | wordfence |
| WF-6edf91de | profit-products-tables-for-woocommerce < 1.0.6.8 |
HIGH | 7.3 | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unaut… | 1.0.6.8 | wordfence |
| WF-6eb57c97 | wolmart < 1.8.12 |
HIGH | 7.3 | The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execut… | 1.8.12 | wordfence |
| WF-6e5e9249 | tickera-event-ticketing-system < 3.5.4.6 |
HIGH | 7.3 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver… | 3.5.4.6 | wordfence |
| WF-6d32f5ee | sms-alert < 3.9.8 |
HIGH | 7.3 | The SMS Alert Order Notifications plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and incl… | 3.9.8 | wordfence |
| WF-6ca9eaf7 | eventon-action-user < 2.5.15 |
HIGH | 7.3 | The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,… | 2.5.15 | wordfence |
| WF-6c4f8798 | userpro < 5.1.2 |
HIGH | 7.3 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to… | 5.1.2 | wordfence |
| WF-6bebb5c6 | allcoach < 1.0.2 |
HIGH | 7.3 | The AllCoach plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.0.1. This is… | 1.0.2 | wordfence |
| WF-6bd74c3f | oauth2-server | HIGH | 7.3 | The WP OAuth2 Server plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.1… | — | wordfence |
| WF-6b08105d | ssquiz < 2.0 |
HIGH | 7.3 | Unspecified vulnerabilities in the SS Quiz plugin before 1.12.2 for WordPress have unspecified impact and attack vectors… | 2.0 | wordfence |
| WF-69caeed4 | essential-addons-for-elementor-lite < 6.7.2 |
HIGH | 7.3 | The Essential Addons for Elementor plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and inc… | 6.7.2 | wordfence |
| WF-68e395c1 | miniorange-login-with-eve-online-google-facebook < 7.0.1 |
HIGH | 7.3 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to account takeover in all versions u… | 7.0.1 | wordfence |
| WF-67ad04d4 | ari-adminer < 1.1.15 |
HIGH | 7.3 | The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in near… | 1.1.15 | wordfence |
| WF-669c50b8 | limit-login-attempts-reloaded < 2.17.4 |
HIGH | 7.3 | LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per I… | 2.17.4 | wordfence |
| WF-65d15ceb | show-me-the-cookies | HIGH | 7.3 | The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, a… | — | wordfence |
| WF-63412848 | ldap-wp-login-integration-with-active-directory < 3.0.2 |
HIGH | 7.3 | The Ldap WP Login / Active Directory Integration plugin for WordPress is vulnerable to authorization bypass and Cross-Si… | 3.0.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →