Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 506 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-b948574a | yith-paypal-express-checkout-for-woocommerce < 1.20.1 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 1.20.1 | wordfence |
| WF-b948574a | yith-woocommerce-subscription < 2.16.1 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 2.16.1 | wordfence |
| WF-b948574a | yith-woocommerce-cart-messages | HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | — | wordfence |
| WF-b948574a | yith-woocommerce-order-tracking < 2.8.0 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 2.8.0 | wordfence |
| WF-b948574a | yith-woocommerce-name-your-price | HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | — | wordfence |
| WF-b948574a | yith-woocommerce-authorizenet-payment-gateway | HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | — | wordfence |
| WF-b948574a | yith-woocommerce-questions-and-answers | HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | — | wordfence |
| WF-b948574a | yith-woocommerce-tab-manager < 1.17.1 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 1.17.1 | wordfence |
| WF-b948574a | yith-woocommerce-product-add-ons < 2.16.0 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 2.16.0 | wordfence |
| WF-b948574a | yith-woocommerce-badges-management < 2.11.0 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 2.11.0 | wordfence |
| WF-b948574a | yith-woocommerce-popup < 1.21.1 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 1.21.1 | wordfence |
| WF-b948574a | yith-woocommerce-zoom-magnifier < 2.15.0 |
HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | 2.15.0 | wordfence |
| WF-b948574a | yith-woocommerce-bulk-product-editing | HIGH | 7.1 | Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the c… | — | wordfence |
| WF-b8d63789 | cloudflare < 1.3.21 |
HIGH | 7.1 | The Cloudflare plugin for WordPress is vulnerable to Cross-Site Scripting via several parameters in versions before 1.3.… | 1.3.21 | wordfence |
| WF-b722bf4e | flashlight | HIGH | 7.1 | The Flashlight theme plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.8.4 … | — | wordfence |
| WF-b6de66ee | custom-banners < 2.1 |
HIGH | 7.1 | Cross-site scripting (XSS) vulnerability in the Custom Banners plugin before 2.1 for WordPress allows remote attackers t… | 2.1 | wordfence |
| WF-b647a6c5 | formidable < 5.5.7 |
HIGH | 7.1 | The Formidable Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl… | 5.5.7 | wordfence |
| WF-b46b5299 | malware-finder | HIGH | 7.1 | Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allow… | — | wordfence |
| WF-b4503e2c | joomsport-sports-league-results-management < 5.6.18 |
HIGH | 7.1 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cro… | 5.6.18 | wordfence |
| WF-b0d8499a | download-manager < 3.2.13 |
HIGH | 7.1 | The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i… | 3.2.13 | wordfence |
| WF-b0b2bdb3 | profile-builder < 3.10.4 |
HIGH | 7.1 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is… | 3.10.4 | wordfence |
| WF-b05ece19 | meenews < 5.2.0 |
HIGH | 7.1 | The Newsletter Meenews plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 5.1.… | 5.2.0 | wordfence |
| WF-af1796b7 | oleggo-livestream | HIGH | 7.1 | Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 … | — | wordfence |
| WF-aed2ec57 | watu < 3.1.2.6 |
HIGH | 7.1 | The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘quiz’ parameter in versi… | 3.1.2.6 | wordfence |
| WF-ae1e198b | wp-user-avatar < 4.16.12 |
HIGH | 7.1 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePr… | 4.16.12 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →