Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,429 vulnerabilities found (page 6 of 1858)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-9670bd32 | mp-timetable < 2.4.12 |
CRITICAL | 9.9 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attri… | 2.4.12 | wordfence |
| WF-964d6dd2 | parcelpanel < 3.9.0 |
CRITICAL | 9.9 | The Shipment Tracking, Tracking, and Order Tracking for WooCommerce – ParcelPanel (Free to install) plugin for WordPre… | 3.9.0 | wordfence |
| WF-9476b41d | profilegrid-user-profiles-groups-and-communities < 5.7.9 |
CRITICAL | 9.9 | The ProfileGrid plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.7.8 due to insu… | 5.7.9 | wordfence |
| WF-93f377a1 | wp-file-manager-pro < 8.3.5 |
CRITICAL | 9.9 | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and… | 8.3.5 | wordfence |
| WF-93f377a1 | wp-file-manager < 7.2.2 |
CRITICAL | 9.9 | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and… | 7.2.2 | wordfence |
| WF-8f50812a | wp-meta-data-filter-and-taxonomy-filter < 1.3.3.4 |
CRITICAL | 9.9 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attr… | 1.3.3.4 | wordfence |
| WF-8edb060b | gallery-album | CRITICAL | 9.9 | The Gallery – Image and Video Gallery with Thumbnails plugin for WordPress is vulnerable to SQL Injection in all versi… | — | wordfence |
| WF-8d54079a | greenshiftquery < 3.9.2 |
CRITICAL | 9.9 | The Greenshift Query and Meta Addon plugin for WordPress is vulnerable to SQL Injection in versions up to 3.9.2 due to i… | 3.9.2 | wordfence |
| WF-8d03af4d | widget-options < 4.0.8 |
CRITICAL | 9.9 | The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code … | 4.0.8 | wordfence |
| WF-8c57211a | controlled-admin-access < 1.5.6 |
CRITICAL | 9.9 | The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including,… | 1.5.6 | wordfence |
| WF-8c2707ae | epoll-wp-voting < 3.5 |
CRITICAL | 9.9 | The WP Poll Maker – Best WordPress Poll Plugin for Voting Contest plugin for WordPress is vulnerable to arbitrary file… | 3.5 | wordfence |
| WF-8c0dc694 | themegrill-demo-importer < 1.6.2 |
CRITICAL | 9.9 | The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability che… | 1.6.2 | wordfence |
| WF-8b104666 | listingpro-plugin < 2.9.5 |
CRITICAL | 9.9 | The ListingPro plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.9.4 due to insuff… | 2.9.5 | wordfence |
| WF-866e4bc3 | daily-prayer-time-for-mosques < 2024.09.14 |
CRITICAL | 9.9 | The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_ver… | 2024.09.14 | wordfence |
| WF-8647005a | responsive-horizontal-vertical-and-accordion-tabs < 1.1.18 |
CRITICAL | 9.9 | The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to SQL Injection in ver… | 1.1.18 | wordfence |
| WF-84090828 | csv-to-html < 3.27 |
CRITICAL | 9.9 | The CSV to html plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all … | 3.27 | wordfence |
| WF-83e5a0dc | php-to-page | CRITICAL | 9.9 | The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and … | — | wordfence |
| WF-83189c51 | wordpress-tooltips < 9.4.5 |
CRITICAL | 9.9 | The WordPress Tooltips plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 9.4.3 d… | 9.4.5 | wordfence |
| WF-80f7e161 | wp-photo-album-plus < 8.6.03.005 |
CRITICAL | 9.9 | The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation… | 8.6.03.005 | wordfence |
| WF-7f3dac5a | integration-dynamics < 1.3.24 |
CRITICAL | 9.9 | The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all … | 1.3.24 | wordfence |
| WF-7e52882e | php-everywhere < 3.0.0 |
CRITICAL | 9.9 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, whic… | 3.0.0 | wordfence |
| WF-7aa62be9 | php-everywhere < 3.0.0 |
CRITICAL | 9.9 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg blo… | 3.0.0 | wordfence |
| WF-79fb4f24 | contest-gallery < 21.3.5 |
CRITICAL | 9.9 | The Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordP… | 21.3.5 | wordfence |
| WF-7832f8fe | wp-jobsearch < 2.6.8 |
CRITICAL | 9.9 | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat… | 2.6.8 | wordfence |
| WF-71105a3c | geodirectory < 2.3.62 |
CRITICAL | 9.9 | The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the geodir_total_listings_count function in ver… | 2.3.62 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →