Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 435 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-ade06c00 | mail-masta | HIGH | 7.2 | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for Wor… | — | wordfence |
| WF-adbc23b3 | contact-form-entries < 1.3.9 |
HIGH | 7.2 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Script… | 1.3.9 | wordfence |
| WF-adb87ef2 | event-registration < 6.03.01 |
HIGH | 7.2 | The Event Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attendees first and last na… | 6.03.01 | wordfence |
| WF-adab6dd8 | photo-gallery < 1.3.51 |
HIGH | 7.2 | The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection v… | 1.3.51 | wordfence |
| WF-ad898303 | nd-booking | HIGH | 7.2 | The Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including… | — | wordfence |
| WF-ad85b322 | hotscot-contact-form < 1.3 |
HIGH | 7.2 | The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the s… | 1.3 | wordfence |
| WF-ad6747da | m-vslider | HIGH | 7.2 | The M-vSlider plugin for WordPress is vulnerable to blind SQL Injection via the ‘rs_id POST’ parameter in versions u… | — | wordfence |
| WF-ad48145b | responsive-lightbox < 2.6.1 |
HIGH | 7.2 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 2.… | 2.6.1 | wordfence |
| WF-ad34d657 | dologin < 3.7 |
HIGH | 7.2 | The DoLogin Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header … | 3.7 | wordfence |
| WF-ad20ddd2 | radio-forge | HIGH | 7.2 | The Radio Forge Muses Player with Skins plugin for WordPress is vulnerable to Cross-Site Scripting via an unknown parame… | — | wordfence |
| WF-ad159b18 | link-whisper < 0.9.1 |
HIGH | 7.2 | The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all… | 0.9.1 | wordfence |
| WF-ace194b6 | smart-forms | HIGH | 7.2 | The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site … | — | wordfence |
| WF-accac3da | post-smtp < 4.0.2 |
HIGH | 7.2 | The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plug… | 4.0.2 | wordfence |
| WF-acb417ba | wp-booking-system < 2.1.0.7 |
HIGH | 7.2 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers… | 2.1.0.7 | wordfence |
| WF-ac9d2b64 | s2b-ai-assistant < 1.7.9 |
HIGH | 7.2 | The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbit… | 1.7.9 | wordfence |
| WF-ac7af0d3 | site-reviews < 8.3.2 |
HIGH | 7.2 | The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including,… | 8.3.2 | wordfence |
| WF-ac6f7b03 | slider-image < 2.7.0 |
HIGH | 7.2 | The Responsive Slider – Image Slider – Slideshow for WordPress plugin for WordPress is vulnerable to multiple SQL In… | 2.7.0 | wordfence |
| WF-ac41d3a8 | post-and-page-builder < 1.27.15 |
HIGH | 7.2 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross… | 1.27.15 | wordfence |
| WF-ac0455a2 | wp-lucky-wheel < 1.0.23 |
HIGH | 7.2 | The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includin… | 1.0.23 | wordfence |
| WF-abc8ee11 | drag-and-drop-multiple-file-upload-for-woocommerce < 1.1.1 |
HIGH | 7.2 | The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | 1.1.1 | wordfence |
| WF-abc056b0 | userfeedback-lite < 1.0.10 |
HIGH | 7.2 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulne… | 1.0.10 | wordfence |
| WF-abbeb5c9 | booking-calendar | HIGH | 7.2 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting in ve… | — | wordfence |
| WF-abac57e7 | admin-site-enhancements-pro < 8.8.6 |
HIGH | 7.2 | The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions … | 8.8.6 | wordfence |
| WF-ab9dd831 | paytm-payments < 2.8.9 |
HIGH | 7.2 | The Paytm Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and i… | 2.8.9 | wordfence |
| WF-ab68a6b2 | booking < 11.8.3 |
HIGH | 7.2 | The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11… | 11.8.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →