Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 563 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-5e640767 | legoeso-pdf-manager | MEDIUM | 6.5 | The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ paramet… | — | wordfence |
| WF-5e408c1b | dynamictags < 1.4.1 |
MEDIUM | 6.5 | The DynamicTags plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.0 due to insuf… | 1.4.1 | wordfence |
| WF-5e3e7c1a | woo-pdf-invoice-builder < 2.0.9 |
MEDIUM | 6.5 | The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to In… | 2.0.9 | wordfence |
| WF-5dc36acb | woo-suggestion-engine < 2.0.12 |
MEDIUM | 6.5 | The Suggestion Engine for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to, and inc… | 2.0.12 | wordfence |
| WF-5dbe5094 | simply-schedule-appointments < 1.6.12.11 |
MEDIUM | 6.5 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to I… | 1.6.12.11 | wordfence |
| WF-5db00eb6 | metform < 3.3.2 |
MEDIUM | 6.5 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update… | 3.3.2 | wordfence |
| WF-5dad7348 | shortcodes-ultimate < 5.12.7 |
MEDIUM | 6.5 | The Shortcodes Ultimate plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 5.12… | 5.12.7 | wordfence |
| WF-5d9736e0 | cart66-lite < 1.5.4 |
MEDIUM | 6.5 | Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remot… | 1.5.4 | wordfence |
| WF-5d78ea71 | cf7-styler | MEDIUM | 6.5 | The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitr… | — | wordfence |
| WF-5d27cead | wpguppy-lite < 1.1.4 |
MEDIUM | 6.5 | The WPGuppy plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.3 due to insuffici… | 1.1.4 | wordfence |
| WF-5d0b26b6 | mapsvg-lite-interactive-vector-maps < 8.14.1 |
MEDIUM | 6.5 | The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to SQL Injection in versions up t… | 8.14.1 | wordfence |
| WF-5cec4c17 | winterlock < 1.2.9 |
MEDIUM | 6.5 | The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi… | 1.2.9 | wordfence |
| WF-5ccfafaf | front-end-only-users < 3.2.25 |
MEDIUM | 6.5 | The Front End Users plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing ca… | 3.2.25 | wordfence |
| WF-5cbbfe66 | wp-docs < 2.2.1 |
MEDIUM | 6.5 | The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up… | 2.2.1 | wordfence |
| WF-5c2d029a | jetformbuilder < 3.6.5.3 |
MEDIUM | 6.5 | The JetFormBuilder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validatio… | 3.6.5.3 | wordfence |
| WF-5c28577f | profilegrid-user-profiles-groups-and-communities < 5.9.9.8 |
MEDIUM | 6.5 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Registration Bypass in a… | 5.9.9.8 | wordfence |
| WF-5bf95020 | dokan-pro < 5.0.5 |
MEDIUM | 6.5 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all vers… | 5.0.5 | wordfence |
| WF-5bdf04e6 | hmenu | MEDIUM | 6.5 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to SQL Injection via several fu… | — | wordfence |
| WF-5bcdeeff | ultimate-wp-mail < 1.3.5 |
MEDIUM | 6.5 | The Ultimate WP Mail plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.3.4 due to … | 1.3.5 | wordfence |
| WF-5b5296ad | media-library-assistant < 3.43 |
MEDIUM | 6.5 | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.… | 3.43 | wordfence |
| WF-5b4f563c | fluent-security < 1.0.2 |
MEDIUM | 6.5 | The FluentAuth plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This i… | 1.0.2 | wordfence |
| WF-5af7055d | circular_countdown | MEDIUM | 6.5 | The CountDown Pro WP Plugin plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7 du… | — | wordfence |
| WF-5af46aef | td-composer < 5.4.5 |
MEDIUM | 6.5 | The The tagDiv Composer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and i… | 5.4.5 | wordfence |
| WF-5ada82fe | lasso | MEDIUM | 6.5 | The Do Lasso plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 358 due to insufficie… | — | wordfence |
| WF-5ac8e551 | export-all-urls < 4.3 |
MEDIUM | 6.5 | The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attac… | 4.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →