Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 40 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-b3ae0e08 | minimog < 3.8.0 |
CRITICAL | 9.8 | The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusio… | 3.8.0 | wordfence |
| WF-b39f4467 | lifterlms < 3.37.15 |
CRITICAL | 9.8 | LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution. | 3.37.15 | wordfence |
| WF-b359ef59 | contact-manager < 9.1.3 |
CRITICAL | 9.8 | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.… | 9.1.3 | wordfence |
| WF-b352b2e4 | wp-contacts-manager | CRITICAL | 9.8 | The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is b… | — | wordfence |
| WF-b3451ed9 | wp-mlm | CRITICAL | 9.8 | The WP MLM SOFTWARE PLUGIN plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat… | — | wordfence |
| WF-b343269f | shopmonitorio < 1.2.0 |
CRITICAL | 9.8 | The ShopMonitor.io – Automated Checkout & Form Monitoring plugin for WordPress is vulnerable to privilege escalation v… | 1.2.0 | wordfence |
| WF-b2ea5e77 | wp-images-upload-on-piclect | CRITICAL | 9.8 | The WP images upload on piclect plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and i… | — | wordfence |
| WF-b2c03142 | mw-wp-form < 5.0.2 |
CRITICAL | 9.8 | The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in … | 5.0.2 | wordfence |
| WF-b2b973fe | simple-form < 3.10.1 |
CRITICAL | 9.8 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerab… | 3.10.1 | wordfence |
| WF-b29dcd7a | quiz-master-next < 8.1.5 |
CRITICAL | 9.8 | The Quiz and Survey Master plugin for WordPress is vulnerable to SQL Injection via the 'question_ids_[XX]' cookie in ver… | 8.1.5 | wordfence |
| WF-b299a932 | ajax-filter-posts < 3.4.13 |
CRITICAL | 9.8 | The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Paginat… | 3.4.13 | wordfence |
| WF-b29918de | naimur-email-otp-for-woocommerce < 2.1.1 |
CRITICAL | 9.8 | The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in version… | 2.1.1 | wordfence |
| WF-b291ed6f | wppageflip < 3.0 |
CRITICAL | 9.8 | Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppa… | 3.0 | wordfence |
| WF-b280155e | biometric-login-for-woocommerce < 1.0.4 |
CRITICAL | 9.8 | The Biometric Login for WooCommerce plugin for WordPress is vulnerable to privilege escalation in versions up to, and in… | 1.0.4 | wordfence |
| WF-b27995b1 | stopbadbots < 6.930 |
CRITICAL | 9.8 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does no… | 6.930 | wordfence |
| WF-b26d61de | eventr | CRITICAL | 9.8 | Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this a… | — | wordfence |
| WF-b25b4aed | woocommerce-abandon-cart-pro < 10.8.1 |
CRITICAL | 9.8 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encrypt… | 10.8.1 | wordfence |
| WF-b2143edf | give < 3.19.3 |
CRITICAL | 9.8 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in al… | 3.19.3 | wordfence |
| WF-b20f94c6 | ciyashop | CRITICAL | 9.8 | The CiyaShop theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.18.0 via dese… | — | wordfence |
| WF-b1e98d2d | delete-all-comments | CRITICAL | 9.8 | The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation… | — | wordfence |
| WF-b1e51951 | woo-social-login < 2.7.0 |
CRITICAL | 9.8 | The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc… | 2.7.0 | wordfence |
| WF-b1cdd6c6 | mylinksdump | CRITICAL | 9.8 | SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to exe… | — | wordfence |
| WF-b1a29180 | sayfa-sayac | CRITICAL | 9.8 | The Sayfa Sayac plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6 via… | — | wordfence |
| WF-b1782c82 | dtracker | CRITICAL | 9.8 | Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id v… | — | wordfence |
| WF-b170ac00 | wordpress < 6.4.2 |
CRITICAL | 9.8 | WordPress Core is vulnerable to remote code execution via a PHP gadget in version 6.4.0 and 6.4.1. This is due to there … | 6.4.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →