Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 476 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-42c1103e | team-section < 2.0.5 |
HIGH | 7.2 | The Team Section Block – Showcase Team Members with Layout Options plugin for WordPress is vulnerable to Stored Cross-… | 2.0.5 | wordfence |
| WF-427034cf | edubin | HIGH | 7.2 | The Edubin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 9.2.0… | — | wordfence |
| WF-424cab53 | codepeople-post-map < 1.2.6 |
HIGH | 7.2 | The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up… | 1.2.6 | wordfence |
| WF-41f6939d | opti-behavior < 1.10.0 |
HIGH | 7.2 | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPre… | 1.10.0 | wordfence |
| WF-41c2ec31 | fluentform < 5.2.7 |
HIGH | 7.2 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulner… | 5.2.7 | wordfence |
| WF-41985e86 | custom-registration-form-builder-with-submission-manager < 6.0.0.2 |
HIGH | 7.2 | The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to … | 6.0.0.2 | wordfence |
| WF-419270e7 | enl-newsletter | HIGH | 7.2 | SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticate… | — | wordfence |
| WF-418a6ed7 | social-polls-by-opinionstage < 19.6.25 |
HIGH | 7.2 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Stored Cross-Site Scripting … | 19.6.25 | wordfence |
| WF-4182c4bb | thirstyaffiliates < 3.12.2 |
HIGH | 7.2 | The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulne… | 3.12.2 | wordfence |
| WF-416ecce7 | radio-player < 2.0.74 |
HIGH | 7.2 | The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerabl… | 2.0.74 | wordfence |
| WF-416e39c1 | translatepress-multilingual < 2.9.7 |
HIGH | 7.2 | The TranslatePress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.9.6 vi… | 2.9.7 | wordfence |
| WF-413962b8 | wp-ulike < 3.2 |
HIGH | 7.2 | The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user supplied IP HTTP Headers paramet… | 3.2 | wordfence |
| WF-412c39e9 | allow-php-execute | HIGH | 7.2 | The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0… | — | wordfence |
| WF-40fa29f5 | litespeed-cache < 7.8 |
HIGH | 7.2 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the /wp-json/litespeed/v1/noti… | 7.8 | wordfence |
| WF-40e4a3d7 | wp-fastest-cache < 1.5.1 |
HIGH | 7.2 | The Fastest Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including… | 1.5.1 | wordfence |
| WF-40d80e47 | updraftplus < 1.16.59 |
HIGH | 7.2 | The UpdraftPlus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.16.56 via… | 1.16.59 | wordfence |
| WF-40abaa5e | jet-engine < 3.7.8 |
HIGH | 7.2 | The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.7.7 … | 3.7.8 | wordfence |
| WF-40a40525 | forminator < 1.58.0 |
HIGH | 7.2 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored C… | 1.58.0 | wordfence |
| WF-407f7165 | sticky-chat-button | HIGH | 7.2 | The Sticky Button – Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up… | — | wordfence |
| WF-40682959 | wp-all-import < 3.7.3 |
HIGH | 7.2 | The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing … | 3.7.3 | wordfence |
| WF-4062f981 | wp-db-backup < 2.5.1 |
HIGH | 7.2 | The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter befor… | 2.5.1 | wordfence |
| WF-4057bfcf | ilive | HIGH | 7.2 | The Intelligent WordPress Live Chat Support Plugin | Utilities plugin for WordPress is vulnerable to Stored Cross-Site S… | — | wordfence |
| WF-404aeb60 | bbq-pro < 3.9.1 |
HIGH | 7.2 | The BBQ Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.… | 3.9.1 | wordfence |
| WF-4045d49f | shopengine < 4.9.5 |
HIGH | 7.2 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerabl… | 4.9.5 | wordfence |
| WF-40092f13 | vikbooking < 1.8.16 |
HIGH | 7.2 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachm… | 1.8.16 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →