Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 47 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-a2d6e595 | psw-login-and-registration | CRITICAL | 9.8 | The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,… | — | wordfence |
| WF-a2d22c5d | acf-frontend-form-element < 3.19.5 |
CRITICAL | 9.8 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling o… | 3.19.5 | wordfence |
| WF-a2871261 | ninja-gdpr-compliance < 2.4 |
CRITICAL | 9.8 | The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and inclu… | 2.4 | wordfence |
| WF-a260c173 | commonsbooking < 2.6.8 |
CRITICAL | 9.8 | The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_dat… | 2.6.8 | wordfence |
| WF-a25528b1 | famous | CRITICAL | 9.8 | The Famous theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the /mega… | — | wordfence |
| WF-a24af0ad | capturly-optimize-your-website < 2.0.2 |
CRITICAL | 9.8 | The Capturly plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.1. This ma… | 2.0.2 | wordfence |
| WF-a234c996 | smart-agreements < 1.0.4 |
CRITICAL | 9.8 | The Smart Agreements plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.3.… | 1.0.4 | wordfence |
| WF-a22932d8 | woopra < 1.4.3.2 |
CRITICAL | 9.8 | The Woopra Analytics Plugin for WordPress is vulnerable to Remote Code Execution in versions before 1.4.3.2 via the 'fil… | 1.4.3.2 | wordfence |
| WF-a213e844 | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders < 1.12.0 |
CRITICAL | 9.8 | The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPr… | 1.12.0 | wordfence |
| WF-a1f62cda | sf-booking < 6.0 |
CRITICAL | 9.8 | The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, … | 6.0 | wordfence |
| WF-a1e2d370 | woocommerce-photo-reviews < 1.3.14 |
CRITICAL | 9.8 | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to,… | 1.3.14 | wordfence |
| WF-a1ce59bf | shipyaari-shipping-managment | CRITICAL | 9.8 | The Shipyaari Shipping Management plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and incl… | — | wordfence |
| WF-a1bb2b06 | king-addons < 51.1.35 |
CRITICAL | 9.8 | The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is … | 51.1.35 | wordfence |
| WF-a19c70d1 | migratico-lite < 2.7.1 |
CRITICAL | 9.8 | The Migratico Lite plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.6… | 2.7.1 | wordfence |
| WF-a192d097 | wp-social-media-login | CRITICAL | 9.8 | The WP Social Media Login plugin for WordPress is vulnerable to Authentication Bypass via the Twitter login flow in all… | — | wordfence |
| WF-a1817c58 | geeky-bot < 1.2.3 |
CRITICAL | 9.8 | The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This … | 1.2.3 | wordfence |
| WF-a1800241 | wti-like-post < 1.4.3 |
CRITICAL | 9.8 | The WTI Like Post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTT… | 1.4.3 | wordfence |
| WF-a146ea86 | typehub | CRITICAL | 9.8 | The Type Hub plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all ver… | — | wordfence |
| WF-a13c364f | registration-form-for-woocommerce < 1.1.0 |
CRITICAL | 9.8 | The Registration Form for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, … | 1.1.0 | wordfence |
| WF-a135a298 | kata-plus < 1.5.4 |
CRITICAL | 9.8 | The Kata Plus plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.3 via des… | 1.5.4 | wordfence |
| WF-a10ba041 | miniorange-openid-connect-client < 2.1.8 |
CRITICAL | 9.8 | The WordPress OpenID Connect Client plugin for WordPress is vulnerable to authentication bypass in versions up to, and i… | 2.1.8 | wordfence |
| WF-a10a3f01 | gift-voucher < 4.3.3 |
CRITICAL | 9.8 | The Gift Cards (Gift Vouchers and Packages) plugin for WordPress is vulnerable to SQL Injection via the 'template' param… | 4.3.3 | wordfence |
| WF-a0da53ab | private-feed-key | CRITICAL | 9.8 | The Private Feed Key plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0… | — | wordfence |
| WF-a0d434ed | everest-backup < 2.3.14 |
CRITICAL | 9.8 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to… | 2.3.14 | wordfence |
| WF-a0cb0970 | wpstorecart < 2.5.30 |
CRITICAL | 9.8 | Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows re… | 2.5.30 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →