Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 408 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-f10a11d8 | one-click-demo-import < 3.2.1 |
HIGH | 7.2 | The One Click Demo Import plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includin… | 3.2.1 | wordfence |
| WF-f105f6bf | survey-maker < 3.6.4 |
HIGH | 7.2 | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in all versi… | 3.6.4 | wordfence |
| WF-f0e6b405 | classified-listing < 5.3.9 |
HIGH | 7.2 | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to S… | 5.3.9 | wordfence |
| WF-f0d05295 | webappick-product-feed-for-woocommerce < 6.5.7 |
HIGH | 7.2 | The CTX Feed – WooCommerce Product Feed Manager Plugin plugin for WordPress is vulnerable to unauthorized modification… | 6.5.7 | wordfence |
| WF-f093dfc8 | demon-image-annotation < 5.4 |
HIGH | 7.2 | The Demon image annotation plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up t… | 5.4 | wordfence |
| WF-f08ad322 | email-before-download < 6.8 |
HIGH | 7.2 | The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET pa… | 6.8 | wordfence |
| WF-f082a21e | ezoic-integration < 2.8.9 |
HIGH | 7.2 | The Ezoic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in versions up to, and includin… | 2.8.9 | wordfence |
| WF-f05a55ba | registrations-for-the-events-calendar < 2.12.4 |
HIGH | 7.2 | The Registrations for the Events Calendar – Event Registration Plugin plugin for WordPress is vulnerable to Stored Cro… | 2.12.4 | wordfence |
| WF-f041dbd3 | hydra-booking < 1.1.45 |
HIGH | 7.2 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site … | 1.1.45 | wordfence |
| WF-f03b09ad | formidable < 6.34 |
HIGH | 7.2 | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is v… | 6.34 | wordfence |
| WF-f00e8169 | tutor < 2.7.2 |
HIGH | 7.2 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection vi… | 2.7.2 | wordfence |
| WF-efdf76b2 | watu < 2.5.0.2 |
HIGH | 7.2 | The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘answer-x’ parameter in vers… | 2.5.0.2 | wordfence |
| WF-efc434fd | smtp-mail < 1.2.2 |
HIGH | 7.2 | The SMTP Mail plugin for WordPress is vulnerable to generic SQL Injection via the ‘order’ and ‘orderby’ paramete… | 1.2.2 | wordfence |
| WF-efab7ec7 | wc-support-system < 1.2.2 |
HIGH | 7.2 | The Woocommerce Support System plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in versio… | 1.2.2 | wordfence |
| WF-ef9ec21b | ultimate-maps-by-supsystic < 1.5.0 |
HIGH | 7.2 | The Ultimate Maps by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 1… | 1.5.0 | wordfence |
| WF-ef9d256b | booking < 6.2.1 |
HIGH | 7.2 | The Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the booking ID field in versions up… | 6.2.1 | wordfence |
| WF-ef888b2e | i-recommend-this < 3.8.2 |
HIGH | 7.2 | The I Recommend This plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.8.1 … | 3.8.2 | wordfence |
| WF-ef6bf903 | if-so < 1.10.2 |
HIGH | 7.2 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored… | 1.10.2 | wordfence |
| WF-ef51095d | tourmaster | HIGH | 7.2 | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all v… | — | wordfence |
| WF-ef20b3e6 | wp-mail-logging < 1.11.2 |
HIGH | 7.2 | The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up … | 1.11.2 | wordfence |
| WF-ef0c6a63 | depicter < 4.8.2 |
HIGH | 7.2 | The Depicter — Popup & Slider Builder plugin for WordPress is vulnerable to Arbitrary File Upload in versions 4.0.5 th… | 4.8.2 | wordfence |
| WF-ef07d6b0 | tablemaster-for-elementor < 1.3.7 |
HIGH | 7.2 | The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a… | 1.3.7 | wordfence |
| WF-eee9e199 | exportfeed-for-woocommerce-google-product-feed | HIGH | 7.2 | The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter wh… | — | wordfence |
| WF-eee60ee9 | advanced-booking-calendar < 1.7.1 |
HIGH | 7.2 | The Advanced Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in … | 1.7.1 | wordfence |
| WF-eea7ddc4 | easy-digital-downloads < 3.6.9.1 |
HIGH | 7.2 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stor… | 3.6.9.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →