Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 575 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-2ee6ffb3 | wpcf7-redirect < 2.3.4 |
MEDIUM | 6.5 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the… | 2.3.4 | wordfence |
| WF-2e6d30c9 | wc-multivendor-marketplace < 3.7.3 |
MEDIUM | 6.5 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to SQL Injection in … | 3.7.3 | wordfence |
| WF-2e5602b2 | fluentform < 6.1.12 |
MEDIUM | 6.5 | The The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is… | 6.1.12 | wordfence |
| WF-2df2312c | formbuilder | MEDIUM | 6.5 | The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting for… | — | wordfence |
| WF-2d980542 | wp-persistent-login < 3.1.1 |
MEDIUM | 6.5 | The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all vers… | 3.1.1 | wordfence |
| WF-2d1414f5 | headless-cms | MEDIUM | 6.5 | The Headless CMS plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability che… | — | wordfence |
| WF-2cfdde5c | taskbuilder < 5.0.3 |
MEDIUM | 6.5 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blin… | 5.0.3 | wordfence |
| WF-2ccadf7c | contact-form-entries < 1.5.2 |
MEDIUM | 6.5 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via … | 1.5.2 | wordfence |
| WF-2cb2ad5d | ai-engine < 3.7.8 |
MEDIUM | 6.5 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Ob… | 3.7.8 | wordfence |
| WF-2bfe721b | wpbulky-wp-bulk-edit-post-types < 1.1.14 |
MEDIUM | 6.5 | The WPBulky plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.13 due to insuffic… | 1.1.14 | wordfence |
| WF-2beaf82f | layouts-for-wpbakery < 1.1.4 |
MEDIUM | 6.5 | The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on… | 1.1.4 | wordfence |
| WF-2bc07a16 | wp-time-slots-booking-form < 1.2.51 |
MEDIUM | 6.5 | The WP Time Slots Booking Form plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.2… | 1.2.51 | wordfence |
| WF-2bb47ffd | media-library-assistant < 3.35 |
MEDIUM | 6.5 | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.34 d… | 3.35 | wordfence |
| WF-2ba63578 | infility-global < 2.15.19 |
MEDIUM | 6.5 | The Infility Global plugin for WordPress is vulnerable to SQL Injection in versions up to 2.15.19 due to insufficient es… | 2.15.19 | wordfence |
| WF-2b99e525 | wp-file-download < 6.3.9 |
MEDIUM | 6.5 | The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3… | 6.3.9 | wordfence |
| WF-2b45674c | moneytigo | MEDIUM | 6.5 | The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives … | — | wordfence |
| WF-2b3644fe | buddyboss-platform | MEDIUM | 6.5 | The BuddyBoss Platform plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0. … | — | wordfence |
| WF-2b11670a | supportcandy < 3.3.8 |
MEDIUM | 6.5 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypa… | 3.3.8 | wordfence |
| WF-2ae7f5e3 | wp-register-profile-with-shortcode < 3.6.3 |
MEDIUM | 6.5 | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi… | 3.6.3 | wordfence |
| WF-2ac1e3ee | ameliabooking < 1.2.5 |
MEDIUM | 6.5 | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to una… | 1.2.5 | wordfence |
| WF-2ac1e3ee | amelia < 7.8 |
MEDIUM | 6.5 | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to una… | 7.8 | wordfence |
| WF-2a965a23 | ai-copilot-content-generator < 1.5.8 |
MEDIUM | 6.5 | The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Par… | 1.5.8 | wordfence |
| WF-2a5ea5b6 | another-wordpress-classifieds-plugin < 4.4.4 |
MEDIUM | 6.5 | The The WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds plugin for WordPress is vulnerable t… | 4.4.4 | wordfence |
| WF-2a4e66e0 | gallery-portfolio < 1.4.6 |
MEDIUM | 6.5 | The Portfolio Gallery – Responsive Image Gallery plugin for WordPress is vulnerable to unauthorized modification and l… | 1.4.6 | wordfence |
| WF-2a47e3cc | wp-members < 3.5.6 |
MEDIUM | 6.5 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'order_by' attribute of the… | 3.5.6 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →