Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 496 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-103db583 | post-smtp < 2.9.4 |
HIGH | 7.2 | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for… | 2.9.4 | wordfence |
| WF-101f8390 | dzs-videogallery | HIGH | 7.2 | The DZS Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'initer' parameter in… | — | wordfence |
| WF-10101e3f | heateor-social-login < 1.1.33 |
HIGH | 7.2 | The Heateor Social Login WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up … | 1.1.33 | wordfence |
| WF-0ffd60d2 | wp-statistics < 14.0 |
HIGH | 7.2 | The WP Statistics plugin for WordPress is vulnerable to SQL Injection via the $days_time_list value in versions up to, a… | 14.0 | wordfence |
| WF-0ff05b7a | assistant < 1.5.1.1 |
HIGH | 7.2 | The Assistant plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.1 via des… | 1.5.1.1 | wordfence |
| WF-0feb873e | generate-pdf-using-contact-form-7 < 4.2.2 |
HIGH | 7.2 | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions … | 4.2.2 | wordfence |
| WF-0fe57abe | affiliatex < 2.3.6 |
HIGH | 7.2 | The AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking plugin for WordPr… | 2.3.6 | wordfence |
| WF-0faa8f07 | acf-frontend-form-element < 3.28.32 |
HIGH | 7.2 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the '… | 3.28.32 | wordfence |
| WF-0fa6a112 | pixelyoursite-pro < 12.4.0.3 |
HIGH | 7.2 | The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' param… | 12.4.0.3 | wordfence |
| WF-0fa49df8 | wp-time-slots-booking-form < 1.2.11 |
HIGH | 7.2 | The WP Time Slots Booking Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, … | 1.2.11 | wordfence |
| WF-0f8aa38b | customily-v2 | HIGH | 7.2 | The Customily Product Personalizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user cookies in… | — | wordfence |
| WF-0f792909 | page-visits-counter-lite < 2.0.0 |
HIGH | 7.2 | The Page Visits Counter – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to… | 2.0.0 | wordfence |
| WF-0f76c9f8 | broken-link-notifier < 1.3.1 |
HIGH | 7.2 | The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and in… | 1.3.1 | wordfence |
| WF-0f6bc166 | wp-super-cache < 1.7.2 |
HIGH | 7.2 | The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due … | 1.7.2 | wordfence |
| WF-0ee7b30f | arforms-form-builder < 1.5.7 |
HIGH | 7.2 | The ARForms Form Builder plugin for WordPress is vulnerable to Cross-Site Scripting via an unspecified parameter in vers… | 1.5.7 | wordfence |
| WF-0ee09d0f | jane-menu < 1.5.1 |
HIGH | 7.2 | The Jane Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.… | 1.5.1 | wordfence |
| WF-0e63ca03 | z-downloads < 1.11.6 |
HIGH | 7.2 | The Z-Downloads plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, … | 1.11.6 | wordfence |
| WF-0e604d56 | dsubscribers < 1.2.1 |
HIGH | 7.2 | The DSubscribers plugin for WordPress is vulnerable to SQL Injection via the ‘dsubscribers’ parameter in versions be… | 1.2.1 | wordfence |
| WF-0e344974 | quiz-master-next < 11.2.7 |
HIGH | 7.2 | The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cr… | 11.2.7 | wordfence |
| WF-0e27a9cb | alipay | HIGH | 7.2 | A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through … | — | wordfence |
| WF-0e2734d5 | linet-erp-woocommerce-integration < 3.6.0 |
HIGH | 7.2 | The Linet ERP-Woocommerce Integration Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insuff… | 3.6.0 | wordfence |
| WF-0de639a9 | infility-global < 2.15.35 |
HIGH | 7.2 | The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in al… | 2.15.35 | wordfence |
| WF-0ddc518c | flying-scripts < 1.2.5 |
HIGH | 7.2 | The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cr… | 1.2.5 | wordfence |
| WF-0dd1ded1 | exmage-wp-image-links < 1.0.7 |
HIGH | 7.2 | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead… | 1.0.7 | wordfence |
| WF-0dc9adad | litespeed-cache < 7.9.1 |
HIGH | 7.2 | The LiteSpeed Cache plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includi… | 7.9.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →