Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 522 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-0a86f6ed | ai-engine < 2.1.5 |
MEDIUM | 6.6 | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file up… | 2.1.5 | wordfence |
| WF-0a6707ef | wordpress < 4.1.40 |
MEDIUM | 6.6 | In all current versions of WordPress Core before 6.4.3, plugins uploaded via the admin area are not verified as being ZI… | 4.1.40 | wordfence |
| WF-08fb51d6 | mediaburst-email-to-sms | MEDIUM | 6.6 | The Clockwork SMS Notfications plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versi… | — | wordfence |
| WF-06863974 | wp-seopress < 6.5.0.3 |
MEDIUM | 6.6 | The SEOPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.5.0.2 via de… | 6.5.0.3 | wordfence |
| WF-03b1376e | computer-repair-shop < 2.0 |
MEDIUM | 6.6 | The Computer Repair Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in ver… | 2.0 | wordfence |
| WF-fffd7d50 | woocommerce-checkout-manager < 7.3.1 |
MEDIUM | 6.5 | The WooCommerce Checkout Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… | 7.3.1 | wordfence |
| WF-fff419fc | collapsing-categories < 3.0.12 |
MEDIUM | 6.5 | The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.0.9 du… | 3.0.12 | wordfence |
| WF-fff1cff1 | td-subscription < 1.7.1 |
MEDIUM | 6.5 | The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId… | 1.7.1 | wordfence |
| WF-ffe1eca0 | ultimate-product-catalogue < 5.0.26 |
MEDIUM | 6.5 | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX act… | 5.0.26 | wordfence |
| WF-ffb8c561 | infility-global | MEDIUM | 6.5 | The Infility Global plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.12.7 due to … | — | wordfence |
| WF-ffb70e82 | accelerated-mobile-pages < 1.0.93.2 |
MEDIUM | 6.5 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a mis… | 1.0.93.2 | wordfence |
| WF-ff6e6101 | browser-and-operating-system-finder | MEDIUM | 6.5 | The Browser and Operating System Finder plugin for WordPress is missing authorization checks on functionality that reset… | — | wordfence |
| WF-ff5d8f5f | email-subscribers < 4.2.3 |
MEDIUM | 6.5 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option c… | 4.2.3 | wordfence |
| WF-ff449224 | geo-mashup < 1.13.13 |
MEDIUM | 6.5 | The Geo Mashup plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1… | 1.13.13 | wordfence |
| WF-ff294b0f | formidable < 6.7.1 |
MEDIUM | 6.5 | The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vu… | 6.7.1 | wordfence |
| WF-fefebdbd | ai-engine < 3.6.6 |
MEDIUM | 6.5 | The AI Engine plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.6.5. This is… | 3.6.6 | wordfence |
| WF-feb0e1f0 | elementinvader-addons-for-elementor < 1.4.3 |
MEDIUM | 6.5 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to SQL Injection in versions up to, and inclu… | 1.4.3 | wordfence |
| WF-fe25393e | the-events-calendar < 6.17.5.1 |
MEDIUM | 6.5 | The The Events Calendar plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.12.0 through 6… | 6.17.5.1 | wordfence |
| WF-fe1e8c38 | events-manager < 7.4.1 |
MEDIUM | 6.5 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injectio… | 7.4.1 | wordfence |
| WF-fdc806de | easy-post-duplicator | MEDIUM | 6.5 | The Easy Post Duplicator plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.1 due… | — | wordfence |
| WF-fd8f3eb7 | woo-wallet < 1.5.7 |
MEDIUM | 6.5 | The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versi… | 1.5.7 | wordfence |
| WF-fd80133d | wp-ultimate-csv-importer < 7.38 |
MEDIUM | 6.5 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all ver… | 7.38 | wordfence |
| WF-fd7916f3 | awesome-support < 3.1.7 |
MEDIUM | 6.5 | The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies. | 3.1.7 | wordfence |
| WF-fd28c405 | streamit < 4.0.2 |
MEDIUM | 6.5 | The Sreamit theme for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 4.0.1. T… | 4.0.2 | wordfence |
| WF-fd063077 | wc-vendors < 2.6.9 |
MEDIUM | 6.5 | The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable … | 2.6.9 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →