Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1038 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-82b4291c | wp-cart-for-digital-products < 8.5.5 |
MEDIUM | 6.1 | The WP eStore plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI in all versions up to… | 8.5.5 | wordfence |
| WF-82b182db | my-white | MEDIUM | 6.1 | The my white theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.0.8… | — | wordfence |
| WF-82b020ea | ultra-admin | MEDIUM | 6.1 | The Ultra WordPress Admin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and in… | — | wordfence |
| WF-82ace2e3 | ninja-forms < 3.15.6 |
MEDIUM | 6.1 | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is… | 3.15.6 | wordfence |
| WF-8278debf | admin-cleanup | MEDIUM | 6.1 | The Admin Cleanup plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… | — | wordfence |
| WF-827220d0 | imoney | MEDIUM | 6.1 | The iMoney plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 0.36 d… | — | wordfence |
| WF-825d9154 | site-reviews < 2.15.3 |
MEDIUM | 6.1 | Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary … | 2.15.3 | wordfence |
| WF-825af974 | easy-set-favicon | MEDIUM | 6.1 | The Easy Set Favicon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includi… | — | wordfence |
| WF-8259508b | display-future-posts | MEDIUM | 6.1 | The Display Future Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… | — | wordfence |
| WF-82583e18 | picture-gallery < 1.6.4 |
MEDIUM | 6.1 | The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site … | 1.6.4 | wordfence |
| WF-8247c654 | instagram-feed < 1.6 |
MEDIUM | 6.1 | The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘acce… | 1.6 | wordfence |
| WF-823677be | wp-ultimate-reviews-free | MEDIUM | 6.1 | The WP Ultimate Reviews FREE plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to,… | — | wordfence |
| WF-8232ff9e | the-pack-addon < 2.0.8.4 |
MEDIUM | 6.1 | The The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) plugin for WordPress is vulnerabl… | 2.0.8.4 | wordfence |
| WF-822f5b92 | wp-download-manager < 1.61 |
MEDIUM | 6.1 | Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote… | 1.61 | wordfence |
| WF-822c0a33 | wpextended < 3.0.10 |
MEDIUM | 6.1 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting … | 3.0.10 | wordfence |
| WF-82259b54 | easy-digital-downloads < 2.9.16 |
MEDIUM | 6.1 | The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. | 2.9.16 | wordfence |
| WF-81fd3ac1 | learnpress < 4.2.5.4 |
MEDIUM | 6.1 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the add… | 4.2.5.4 | wordfence |
| WF-81f4f8e8 | captcha-in-thai | MEDIUM | 6.1 | The CAPTCHA in Thai plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘noise’ and ‘dist… | — | wordfence |
| WF-81ebbfb5 | woocommerce-jetpack < 7.2.6 |
MEDIUM | 6.1 | The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and … | 7.2.6 | wordfence |
| WF-81d73996 | secure-copy-content-protection < 4.2.4 |
MEDIUM | 6.1 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Reflected Cross-Site Script… | 4.2.4 | wordfence |
| WF-81d28e90 | translatepress-multilingual < 3.2.6 |
MEDIUM | 6.1 | The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… | 3.2.6 | wordfence |
| WF-81cc09ee | booking-calendar-pro < 11.2.20 |
MEDIUM | 6.1 | The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via… | 11.2.20 | wordfence |
| WF-81cc09ee | booking-calendar < 3.2.20 |
MEDIUM | 6.1 | The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via… | 3.2.20 | wordfence |
| WF-81ca577d | dt-the7 < 2.1.1 |
MEDIUM | 6.1 | The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Cross-Site Scripting in ve… | 2.1.1 | wordfence |
| WF-81bedea8 | soundcloud-is-gold < 2.2.1 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to i… | 2.2.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →