Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 455 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-77582ba1 | translatepress-multilingual < 2.3.3 |
HIGH | 7.2 | The Translate Multilingual sites WordPress plugin is vulnerable to an authenticated SQL injection in versions up to, and… | 2.3.3 | wordfence |
| WF-77537eb8 | mail-control < 0.3.2 |
HIGH | 7.2 | The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up t… | 0.3.2 | wordfence |
| WF-77328e35 | apppresser < 4.4.11 |
HIGH | 7.2 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title… | 4.4.11 | wordfence |
| WF-772c9330 | usc-e-shop < 2.8.11 |
HIGH | 7.2 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin… | 2.8.11 | wordfence |
| WF-772c4a92 | wp-crowdfunding | HIGH | 7.2 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi… | — | wordfence |
| WF-7721c49c | clover-online-orders < 1.6.2 |
HIGH | 7.2 | The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a… | 1.6.2 | wordfence |
| WF-76fb0ffd | woo-advanced-shipment-tracking < 3.9.1 |
HIGH | 7.2 | The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_pro… | 3.9.1 | wordfence |
| WF-76e468fe | master-slider | HIGH | 7.2 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versi… | — | wordfence |
| WF-76c5559d | gallery-plugin < 4.7.4 |
HIGH | 7.2 | The Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin for WordPress is vulnerable t… | 4.7.4 | wordfence |
| WF-76c468cb | groundhogg < 2.7.9.4 |
HIGH | 7.2 | The Groundhogg plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.9.3 due to ins… | 2.7.9.4 | wordfence |
| WF-76bec529 | real-estate-manager < 7.4 |
HIGH | 7.2 | The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Sit… | 7.4 | wordfence |
| WF-769d05ce | bp-instant-chat | HIGH | 7.2 | The BuddyPress Instant Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and… | — | wordfence |
| WF-769a39e0 | relevanssi-premium < 2.31.5 |
HIGH | 7.2 | The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all … | 2.31.5 | wordfence |
| WF-76734ad0 | donations-block < 2.2.0 |
HIGH | 7.2 | The Donation Block For PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donner_name' pa… | 2.2.0 | wordfence |
| WF-7659ac9b | td-subscription < 1.5 |
HIGH | 7.2 | The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the '… | 1.5 | wordfence |
| WF-762fe5b1 | events-manager < 7.4.3 |
HIGH | 7.2 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Sc… | 7.4.3 | wordfence |
| WF-762c45a4 | hurrakify < 8.0.1 |
HIGH | 7.2 | The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.… | 8.0.1 | wordfence |
| WF-75f01eb4 | supportcandy < 3.1.7 |
HIGH | 7.2 | The SupportCandy plugin for WordPress is vulnerable to SQL injection via the 'agents[]' parameter used in the set_add_ag… | 3.1.7 | wordfence |
| WF-75e9b879 | csv-mass-importer | HIGH | 7.2 | The CSV Mass Importer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation i… | — | wordfence |
| WF-75e02357 | easy-wp-smtp < 1.5.2 |
HIGH | 7.2 | The Easy WP SMTP plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.5.1 pos… | 1.5.2 | wordfence |
| WF-758f9402 | jet-appointments-booking < 2.5.3 |
HIGH | 7.2 | The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in… | 2.5.3 | wordfence |
| WF-758e23e4 | ultimate-maps-by-supsystic < 1.1.17 |
HIGH | 7.2 | The Ultimate Maps by Supsystic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1… | 1.1.17 | wordfence |
| WF-756679f3 | wp-stats-manager < 8.8 |
HIGH | 7.2 | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the … | 8.8 | wordfence |
| WF-75388e1c | popup-maker < 1.24.0 |
HIGH | 7.2 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPres… | 1.24.0 | wordfence |
| WF-75324bf1 | aryo-activity-log < 2.11.2 |
HIGH | 7.2 | The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 2.11.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →