Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 409 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-eea05676 | jet-booking < 4.1.2.1 |
HIGH | 7.2 | The JetBooking plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4… | 4.1.2.1 | wordfence |
| WF-ee912e24 | bit-integrations < 2.10.7 |
HIGH | 7.2 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vu… | 2.10.7 | wordfence |
| WF-ee7eb754 | neshan-maps | HIGH | 7.2 | The Neshan Maps plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and includ… | — | wordfence |
| WF-ee2bbe3a | arabic-font | HIGH | 7.2 | The Arabic Font plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'arabic-font.php' and '/inc/pa… | — | wordfence |
| WF-ee27a988 | elementor < 2.8.4 |
HIGH | 7.2 | The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template. | 2.8.4 | wordfence |
| WF-ee269bc7 | wp-smtp < 1.2.7 |
HIGH | 7.2 | The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due … | 1.2.7 | wordfence |
| WF-ee135d1f | popup-by-supsystic < 1.13.2 |
HIGH | 7.2 | The Smart Popup by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, an… | 1.13.2 | wordfence |
| WF-ededbe81 | wp-marketing-automations < 3.5.2 |
HIGH | 7.2 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vul… | 3.5.2 | wordfence |
| WF-ede61e8f | smugmug-embed | HIGH | 7.2 | The SmugMug Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including… | — | wordfence |
| WF-edb82429 | otter-blocks < 3.2.8 |
HIGH | 7.2 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sto… | 3.2.8 | wordfence |
| WF-edb0ee0c | ht-contactform < 2.8.3 |
HIGH | 7.2 | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site S… | 2.8.3 | wordfence |
| WF-edaec73f | nextgen-gallery < 3.39 |
HIGH | 7.2 | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to PHAR Deserialization in all versi… | 3.39 | wordfence |
| WF-ed9ae337 | adrotate < 5.8.4 |
HIGH | 7.2 | Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via para… | 5.8.4 | wordfence |
| WF-ed8f8984 | woocommerce-product-vendors < 2.1.77 |
HIGH | 7.2 | The WooCommerce Product Vendors plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.… | 2.1.77 | wordfence |
| WF-ed8cb22d | motopress-hotel-booking-lite < 6.3.0 |
HIGH | 7.2 | The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook eve… | 6.3.0 | wordfence |
| WF-ed7587d3 | mapster-wp-maps < 2.0.5 |
HIGH | 7.2 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi… | 2.0.5 | wordfence |
| WF-ed28fe16 | ultimate-member < 2.5.1 |
HIGH | 7.2 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 … | 2.5.1 | wordfence |
| WF-ed1ba10b | fluent-cart < 1.3.0 |
HIGH | 7.2 | The FluentCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 1.3.0 due to insuffic… | 1.3.0 | wordfence |
| WF-ecc59a6f | media-library-assistant < 3.06 |
HIGH | 7.2 | The Media Library Assistant for WordPress is vulnerable to SQL Injection via the ‘post_types’ parameter in versions … | 3.06 | wordfence |
| WF-ec9636d5 | fusion-builder < 3.16.2 |
HIGH | 7.2 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynam… | 3.16.2 | wordfence |
| WF-ec96308f | broken-link-checker < 2.4.13.1 |
HIGH | 7.2 | The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link … | 2.4.13.1 | wordfence |
| WF-ec3ef618 | modula < 2.10.9 |
HIGH | 7.2 | The Modula - PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1… | 2.10.9 | wordfence |
| WF-ec2c0542 | tourfic < 2.15.4 |
HIGH | 7.2 | The Tourfic – Ultimate Hotel Booking, Travel Booking & Car Rental WordPress Plugin | WooCommerce Booking plugin for Wo… | 2.15.4 | wordfence |
| WF-ec2276d6 | pepro-ultimate-invoice | HIGH | 7.2 | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a… | — | wordfence |
| WF-ebdac9a2 | rencontre < 3.1.3 |
HIGH | 7.2 | The Rencontre – Dating Site plugin for WordPress is vulnerable to SQL Injection via a few parameters found in the inc/… | 3.1.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →