Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 529 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-e2e4b83a | elex-bulk-edit-products-prices-attributes-for-woocommerce-basic < 1.5.0 |
MEDIUM | 6.5 | The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injectio… | 1.5.0 | wordfence |
| WF-e2ce9caf | smart-slider-3 < 3.5.1.34 |
MEDIUM | 6.5 | The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1… | 3.5.1.34 | wordfence |
| WF-e2c8838c | gotmls < 4.23.83 |
MEDIUM | 6.5 | The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all vers… | 4.23.83 | wordfence |
| WF-e2886f2e | views-for-ninja-forms < 3.3.3 |
MEDIUM | 6.5 | The Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin for WordPress is vulnerabl… | 3.3.3 | wordfence |
| WF-e2857fd0 | kivicare-clinic-management-system < 4.5.1 |
MEDIUM | 6.5 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection vi… | 4.5.1 | wordfence |
| WF-e2318ae9 | woocommerce-multi-currency < 2.1.18 |
MEDIUM | 6.5 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability ch… | 2.1.18 | wordfence |
| WF-e229ab5e | 404-to-301 < 3.0.9 |
MEDIUM | 6.5 | The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place w… | 3.0.9 | wordfence |
| WF-e20deec4 | woo-mailerlite < 3.1.4 |
MEDIUM | 6.5 | The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deleti… | 3.1.4 | wordfence |
| WF-e1ebbb18 | coreactivity < 2.7.1 |
MEDIUM | 6.5 | The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and… | 2.7.1 | wordfence |
| WF-e1bbd339 | latepoint < 5.2.8 |
MEDIUM | 6.5 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injectio… | 5.2.8 | wordfence |
| WF-e1686441 | yds-support-ticket-system | MEDIUM | 6.5 | The YDS Support Ticket System plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, … | — | wordfence |
| WF-e163555b | wp-review-slider-pro < 12.7.12 |
MEDIUM | 6.5 | The Review Slider Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 12.7.11.… | 12.7.12 | wordfence |
| WF-e1167864 | attendance-manager < 0.6.3 |
MEDIUM | 6.5 | The Attendance Manager plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 0.6.2 due t… | 0.6.3 | wordfence |
| WF-e0b87bee | porsline < 1.1 |
MEDIUM | 6.5 | The Porsline plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.2 due to insuffic… | 1.1 | wordfence |
| WF-e0891211 | download-plugin < 2.2.1 |
MEDIUM | 6.5 | The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks… | 2.2.1 | wordfence |
| WF-e0365efc | user-meta-manager < 3.4.8 |
MEDIUM | 6.5 | The User Meta Manager for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 3.4.7 via… | 3.4.8 | wordfence |
| WF-e024d5c7 | starter-templates | MEDIUM | 6.5 | The Starter Templates by FancyWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,… | — | wordfence |
| WF-e014d8b6 | defender-security < 4.4.2 |
MEDIUM | 6.5 | The Defender Security – Malware Scanner, Login Security & Firewall plugin for WordPress is vulnerable to IP Address Sp… | 4.4.2 | wordfence |
| WF-dfd3e6e9 | revy | MEDIUM | 6.5 | The Revy plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1 due to insufficient e… | — | wordfence |
| WF-df6f4e7a | wedevs-project-manager-business | MEDIUM | 6.5 | The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0… | — | wordfence |
| WF-df5ddcc0 | userswp < 1.2.45 |
MEDIUM | 6.5 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin fo… | 1.2.45 | wordfence |
| WF-df4f4358 | ninja-forms < 3.14.2 |
MEDIUM | 6.5 | The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Informati… | 3.14.2 | wordfence |
| WF-df268fbf | sign-up-sheets < 2.3.1 |
MEDIUM | 6.5 | The The Sign-up Sheets plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and in… | 2.3.1 | wordfence |
| WF-ded1944f | simple-basic-contact-form < 20240511 |
MEDIUM | 6.5 | The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all v… | 20240511 | wordfence |
| WF-decc6122 | ukr-to-lat | MEDIUM | 6.5 | The Ukr-To-Lat plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.3.5. This is … | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →