Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1034 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-87135f68 | smooth-dynamic-slider | MEDIUM | 6.1 | The Smooth Dynamic Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, an… | — | wordfence |
| WF-87045c4e | bakkbone-florist-companion < 7.3.0 |
MEDIUM | 6.1 | The FloristPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, … | 7.3.0 | wordfence |
| WF-87019de5 | just-wp-variables | MEDIUM | 6.1 | The Just Variables plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.… | — | wordfence |
| WF-86fe0238 | cf7-manual-spam-blocker | MEDIUM | 6.1 | The WordPress Spam Blocker | Stop Spam for Contact Form 7, WP Forms and Formidable Forms plugin for WordPress is vulnera… | — | wordfence |
| WF-86f95721 | jetapo < 1.1 |
MEDIUM | 6.1 | The Jetapo | Jobboard WordPress Theme and Jetapo | Jobboard WordPress Theme with WooCommerce for WordPress is vulnerable… | 1.1 | wordfence |
| WF-86f95721 | jetapo-with-woocommerce < 1.1 |
MEDIUM | 6.1 | The Jetapo | Jobboard WordPress Theme and Jetapo | Jobboard WordPress Theme with WooCommerce for WordPress is vulnerable… | 1.1 | wordfence |
| WF-86e6a246 | afterpay-gateway-for-woocommerce < 3.2.1 |
MEDIUM | 6.1 | The Afterpay Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ord… | 3.2.1 | wordfence |
| WF-86e0ae2b | index-wp-mysql-for-speed < 1.4.18 |
MEDIUM | 6.1 | The Index WP MySQL For Speed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to,… | 1.4.18 | wordfence |
| WF-86e01e59 | grandconference-custom-post < 2.6.4 |
MEDIUM | 6.1 | The Grand Conference Theme Custom Post Type plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in vers… | 2.6.4 | wordfence |
| WF-86d54e0c | web-testimonials | MEDIUM | 6.1 | The Web Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… | — | wordfence |
| WF-86cb08ae | mailchimp-for-wp < 4.1.7 |
MEDIUM | 6.1 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the use of a… | 4.1.7 | wordfence |
| WF-86c3ef76 | easy-social-icons < 3.1.3 |
MEDIUM | 6.1 | The Easy Social Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in ver… | 3.1.3 | wordfence |
| WF-86ba4092 | lawpress | MEDIUM | 6.1 | The LawPress – Law Firm Website Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all… | — | wordfence |
| WF-86b85505 | team-rosters < 4.8 |
MEDIUM | 6.1 | The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all… | 4.8 | wordfence |
| WF-86b1710d | gwebpro-store-locator | MEDIUM | 6.1 | The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, … | — | wordfence |
| WF-8693a8b1 | keep-backup-daily < 2.0.3 |
MEDIUM | 6.1 | The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in … | 2.0.3 | wordfence |
| WF-868905af | sender-net-automated-emails < 2.6.16 |
MEDIUM | 6.1 | The Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin for WordPress is vulnerable to Refl… | 2.6.16 | wordfence |
| WF-8683bc00 | pixelstats | MEDIUM | 6.1 | The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' param… | — | wordfence |
| WF-86616f56 | filtre-de-surveillance-gouvernemental | MEDIUM | 6.1 | … | — | wordfence |
| WF-8650383a | wpss | MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress… | — | wordfence |
| WF-86389489 | mailchimp-wp < 2.5.8 |
MEDIUM | 6.1 | The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-… | 2.5.8 | wordfence |
| WF-86358a01 | mg-advancedoptions | MEDIUM | 6.1 | The MG AdvancedOptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF'… | — | wordfence |
| WF-862f8743 | wedesin-html-sitemap | MEDIUM | 6.1 | The Digihood HTML Sitemap plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘channel' param… | — | wordfence |
| WF-862d6ae8 | wsify-widget | MEDIUM | 6.1 | The Wsify Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.… | — | wordfence |
| WF-862ab8c7 | infusionsoft < 1.5.7 |
MEDIUM | 6.1 | Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusi… | 1.5.7 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →