Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 84 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-46f3cc62 | ht-mega-for-elementor < 2.2.1 |
CRITICAL | 9.8 | The HT Mega plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.2.0. This is… | 2.2.1 | wordfence |
| WF-46f31a60 | recently-viewed-products | CRITICAL | 9.8 | The Recently Viewed Products plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including… | — | wordfence |
| WF-46d83cc9 | eventon-lite < 2.4.1 |
CRITICAL | 9.8 | The EventON plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.4. This makes… | 2.4.1 | wordfence |
| WF-46b3f3fb | google-map-wp < 2.2.6 |
CRITICAL | 9.8 | The Google Map plugin for WordPress is vulnerable to blind SQL Injection via the ‘table’ parameter in versions up to… | 2.2.6 | wordfence |
| WF-46b3b01c | wp-syntax < 0.9.10 |
CRITICAL | 9.8 | WP-Syntax plugin 0.9.9 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbi… | 0.9.10 | wordfence |
| WF-4666afa0 | sms-alert < 4.0.1 |
CRITICAL | 9.8 | The SMS Alert plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 4.0.0. This i… | 4.0.1 | wordfence |
| WF-46545227 | wp-statistics < 13.1.6 |
CRITICAL | 9.8 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t… | 13.1.6 | wordfence |
| WF-4624d197 | global-flash-galleries < 0.15.2 |
CRITICAL | 9.8 | The Global Flash Gallery Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio… | 0.15.2 | wordfence |
| WF-462125cd | woo-product-design | CRITICAL | 9.8 | The Woocommerce Product Design plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val… | — | wordfence |
| WF-45e0664a | kernel-theme | CRITICAL | 9.8 | The kernel-theme theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the… | — | wordfence |
| WF-45d66743 | ce21-suite < 2.2.1 |
CRITICAL | 9.8 | The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This… | 2.2.1 | wordfence |
| WF-45b6a72a | allwebmenus-wordpress-menu-plugin < 1.1.4 |
CRITICAL | 9.8 | PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attac… | 1.1.4 | wordfence |
| WF-45a778cc | ruza < 1.0.8 |
CRITICAL | 9.8 | The Ruza theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.7. This makes i… | 1.0.8 | wordfence |
| WF-4592fea7 | abtest | CRITICAL | 9.8 | The A/B Test for WordPress plugin for WordPress is vulnerable to Local File Inclusion via the 'action' parameter in the … | — | wordfence |
| WF-45760755 | wp-smart-import < 1.1.4 |
CRITICAL | 9.8 | The WP Smart Import plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.3. … | 1.1.4 | wordfence |
| WF-45531492 | wplms < 1.9.9.1 |
CRITICAL | 9.8 | The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file up… | 1.9.9.1 | wordfence |
| WF-45240c80 | docket-cache < 24.07.03 |
CRITICAL | 9.8 | The Docket Cache plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 24.07.02. … | 24.07.03 | wordfence |
| WF-451db756 | themify-wc-product-filter < 1.5.0 |
CRITICAL | 9.8 | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘con… | 1.5.0 | wordfence |
| WF-45163d7f | wp-symposium < 12.12 |
CRITICAL | 9.8 | The WP Symposium plugin for WordPress is vulnerable to various SQL Injections in versions up to, and including, 12.09 du… | 12.12 | wordfence |
| WF-44edf44b | js-jobs | CRITICAL | 9.8 | The JS Job Manager plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.2. T… | — | wordfence |
| WF-44e54ac5 | reflex-gallery < 3.1.4 |
CRITICAL | 9.8 | Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 f… | 3.1.4 | wordfence |
| WF-44d63454 | sigmaforms-pro < 1.4.6 |
CRITICAL | 9.8 | The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.… | 1.4.6 | wordfence |
| WF-44c96df2 | bp-social-connect < 1.6.2 |
CRITICAL | 9.8 | The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5.… | 1.6.2 | wordfence |
| WF-44c0c0a0 | advanced-custom-post-type < 2.0.67 |
CRITICAL | 9.8 | The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.… | 2.0.67 | wordfence |
| WF-44ba3eee | wpforo < 1.5.2 |
CRITICAL | 9.8 | An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum… | 1.5.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →