Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1047 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-7a5e3d82 | tiempocom | MEDIUM | 6.1 | The Tiempo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in versions… | — | wordfence |
| WF-7a5a33fd | push-notification-by-feedify < 2.4.3 |
MEDIUM | 6.1 | The Feedify – Web Push Notifications plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pla… | 2.4.3 | wordfence |
| WF-7a48eaf5 | adif-log-search-widget | MEDIUM | 6.1 | The ADIF Log Search Widget plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and i… | — | wordfence |
| WF-7a2f1cc7 | epeken-all-kurir < 2.1.2 |
MEDIUM | 6.1 | The Epeken All Kurir Plugin for Woocommerce Full Version plugin for WordPress is vulnerable to Cross-Site Request Forger… | 2.1.2 | wordfence |
| WF-7a1fb413 | photo-gallery < 1.8.43 |
MEDIUM | 6.1 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site … | 1.8.43 | wordfence |
| WF-7a1f91a3 | gd-bbpress-attachments < 2.3 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPre… | 2.3 | wordfence |
| WF-7a1044f0 | wc-multivendor-marketplace < 3.6.12 |
MEDIUM | 6.1 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-S… | 3.6.12 | wordfence |
| WF-79fcf18e | download-manager < 3.2.43 |
MEDIUM | 6.1 | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and includi… | 3.2.43 | wordfence |
| WF-79f03bfe | yslider | MEDIUM | 6.1 | The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versi… | — | wordfence |
| WF-79af711e | wp-abstracts-manuscripts-manager < 2.7.3 |
MEDIUM | 6.1 | The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, … | 2.7.3 | wordfence |
| WF-79ae682a | social-media-auto-publish < 3.6.6 |
MEDIUM | 6.1 | The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage param… | 3.6.6 | wordfence |
| WF-799975aa | smart-donations | MEDIUM | 6.1 | The Donations Made Easy – Smart Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the re… | — | wordfence |
| WF-79844b53 | cultbooking-booking-engine | MEDIUM | 6.1 | The CultBooking Hotel Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… | — | wordfence |
| WF-797faa73 | easy-social-share-buttons3 < 9.5 |
MEDIUM | 6.1 | The easy-social-share-buttons3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown param… | 9.5 | wordfence |
| WF-7948dc00 | wp-programmmanager | MEDIUM | 6.1 | The WP-PManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and includin… | — | wordfence |
| WF-793df609 | crm-perks-forms < 1.1.1 |
MEDIUM | 6.1 | The CRM Perks Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includin… | 1.1.1 | wordfence |
| WF-7938e9f4 | ebook-store < 5.8015 |
MEDIUM | 6.1 | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['REQUEST_URI'] par… | 5.8015 | wordfence |
| WF-792d6c70 | rsvp < 2.3.8 |
MEDIUM | 6.1 | The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen. | 2.3.8 | wordfence |
| WF-7921c896 | choices | MEDIUM | 6.1 | The Choices theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization a… | — | wordfence |
| WF-790c1783 | wpp-customization | MEDIUM | 6.1 | The Admin Customization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… | — | wordfence |
| WF-78fef897 | import-users-from-csv-with-meta < 1.14.1.3 |
MEDIUM | 6.1 | The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. | 1.14.1.3 | wordfence |
| WF-78f90656 | complianz-gdpr < 6.0.0 |
MEDIUM | 6.1 | The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in… | 6.0.0 | wordfence |
| WF-78f08c2b | age-verify < 0.2.9 |
MEDIUM | 6.1 | The Age Verify plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 0.… | 0.2.9 | wordfence |
| WF-78f04982 | multilanguage < 1.2.3 |
MEDIUM | 6.1 | The Multilanguage by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘categor… | 1.2.3 | wordfence |
| WF-78c19531 | appointment-booking-calendar < 1.3.19 |
MEDIUM | 6.1 | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea para… | 1.3.19 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →