Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 469 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-5349815d | visitors-traffic-real-time-statistics < 8.17 |
HIGH | 7.2 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via… | 8.17 | wordfence |
| WF-5340204a | ninja-forms < 3.6.4 |
HIGH | 7.2 | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul… | 3.6.4 | wordfence |
| WF-5339024c | cleantalk-spam-protect < 6.79 |
HIGH | 7.2 | The CleanTalk Anti-Spam. Spam Firewall & Bot protection plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… | 6.79 | wordfence |
| WF-5331c7cc | smart-forms < 2.1.1 |
HIGH | 7.2 | The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to authorization bypa… | 2.1.1 | wordfence |
| WF-53171e83 | wpf-add-on-by-click5 | HIGH | 7.2 | The click5 CRM add-on to WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to… | — | wordfence |
| WF-53124575 | catalog | HIGH | 7.2 | The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from… | — | wordfence |
| WF-52efc168 | custom-registration-form-builder-with-submission-manager < 5.0.2.2 |
HIGH | 7.2 | The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using… | 5.0.2.2 | wordfence |
| WF-52d390e0 | wp-all-import < 3.2.5 |
HIGH | 7.2 | The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter… | 3.2.5 | wordfence |
| WF-52d390e0 | wp-all-import-pro < 4.1.2 |
HIGH | 7.2 | The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter… | 4.1.2 | wordfence |
| WF-52d1cf26 | product-filter-widget-for-elementor | HIGH | 7.2 | The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up… | — | wordfence |
| WF-52c4c16f | woocommerce-catalog-enquiry < 5.0.3 |
HIGH | 7.2 | The Product Catalog Mode For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cust… | 5.0.3 | wordfence |
| WF-52c19956 | weglot < 6.4.3 |
HIGH | 7.2 | The Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.2… | 6.4.3 | wordfence |
| WF-52b13188 | everest-backup < 2.2.5 |
HIGH | 7.2 | The Everest Backup plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in t… | 2.2.5 | wordfence |
| WF-527c344e | wpcf7-redirect < 2.8.0 |
HIGH | 7.2 | The Redirection for Contact Form 7 plugin is vulnerable to Authenticated Privilege Escalation in versions up to, and inc… | 2.8.0 | wordfence |
| WF-52784505 | wp-ecommerce-paypal < 2.0.5 |
HIGH | 7.2 | The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up… | 2.0.5 | wordfence |
| WF-527630bf | usc-e-shop < 2.12.2 |
HIGH | 7.2 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' paramete… | 2.12.2 | wordfence |
| WF-526add70 | cost-calculator-builder-pro < 3.1.68 |
HIGH | 7.2 | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature… | 3.1.68 | wordfence |
| WF-524387e3 | wpcf7-redirect < 3.2.12 |
HIGH | 7.2 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 2.2.7 t… | 3.2.12 | wordfence |
| WF-52432f35 | swatchly < 1.4.14 |
HIGH | 7.2 | The Swatchly – Product Variation Swatches for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scri… | 1.4.14 | wordfence |
| WF-5242f5e4 | dlm-wpforms-lock < 1.0.5 |
HIGH | 7.2 | The Download Monitor - WPForms Lock plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to,… | 1.0.5 | wordfence |
| WF-521bcfd5 | note-press | HIGH | 7.2 | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various … | — | wordfence |
| WF-5219ef67 | notification-for-telegram < 3.5.1 |
HIGH | 7.2 | The Notification for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and i… | 3.5.1 | wordfence |
| WF-52158d56 | bsk-pdf-manager | HIGH | 7.2 | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi… | — | wordfence |
| WF-51f42876 | contact-form-to-db | HIGH | 7.2 | The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to S… | — | wordfence |
| WF-51ea4966 | event-tickets < 5.29.3 |
HIGH | 7.2 | The Event Tickets and Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up … | 5.29.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →