Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1061 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-6a8cb8ef | content-excel-importer < 4.3 |
MEDIUM | 6.1 | The Import Content in WordPress & WooCommerce with Excel plugin for WordPress is vulnerable to Reflected Cross-Site Scri… | 4.3 | wordfence |
| WF-6a89c48d | listings-for-appfolio < 1.2.1 |
MEDIUM | 6.1 | The Listings for Appfolio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in… | 1.2.1 | wordfence |
| WF-6a80dd84 | document-gallery < 5.1.2 |
MEDIUM | 6.1 | The Document Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and inc… | 5.1.2 | wordfence |
| WF-6a76116a | calculated-fields-form < 1.2.55 |
MEDIUM | 6.1 | The Calculated Fields Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters … | 1.2.55 | wordfence |
| WF-6a6390d2 | download-manager < 2.2.3 |
MEDIUM | 6.1 | The Download Manager plugin for WordPress is vulnerable to Cross-Site Scripting via the 'cid' parameter in versions up t… | 2.2.3 | wordfence |
| WF-6a4def27 | simple-al-slider | MEDIUM | 6.1 | The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and inc… | — | wordfence |
| WF-6a1f2a7d | hmapsprem < 2.2.3 |
MEDIUM | 6.1 | The Hero Maps Premium plugin 2.2.2 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index… | 2.2.3 | wordfence |
| WF-6a09e351 | dzs-videogallery < 9.64 |
MEDIUM | 6.1 | The DZS Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ajax.php 'source' par… | 9.64 | wordfence |
| WF-6a03792a | exchange-addon-table-rate-shipping < 1.1.0 |
MEDIUM | 6.1 | Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_… | 1.1.0 | wordfence |
| WF-69fd66db | inpost-gallery < 2.1.4.2 |
MEDIUM | 6.1 | The InPost Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘imgurl’ parameter o… | 2.1.4.2 | wordfence |
| WF-69e92c75 | wp-file-manager < 3.0 |
MEDIUM | 6.1 | The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_f… | 3.0 | wordfence |
| WF-69e15a1b | ultimate-reviews < 3.2.9 |
MEDIUM | 6.1 | The Ultimate Reviews plugin for WordPress is vulnerable to stored Cross-Site Scripting via the review functionality in v… | 3.2.9 | wordfence |
| WF-69c176ae | form-maker < 1.15.47 |
MEDIUM | 6.1 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Refle… | 1.15.47 | wordfence |
| WF-69ac1e37 | themify-builder < 7.6.6 |
MEDIUM | 6.1 | The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg… | 7.6.6 | wordfence |
| WF-69a85ee3 | isape | MEDIUM | 6.1 | The iSape plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 0.72 du… | — | wordfence |
| WF-69a2bce2 | interactive-us-map | MEDIUM | 6.1 | The Interactive US Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… | — | wordfence |
| WF-69a0262e | sermon-browser < 0.43.6 |
MEDIUM | 6.1 | The Sermon Browser plugin for WordPress is vulnerable to Cross-Site Scripting via the 'file_name' parameter in versions … | 0.43.6 | wordfence |
| WF-699a83e0 | wpappninja < 11.42 |
MEDIUM | 6.1 | The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to Reflected Cross-Site Scrip… | 11.42 | wordfence |
| WF-699392b4 | wp-widget-changer | MEDIUM | 6.1 | The WP Widget Changer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']… | — | wordfence |
| WF-69903c2e | eunoia | MEDIUM | 6.1 | The Eunoia theme for WordPress is vulnerable to Cross-Site Scripting in all versions due to insufficient input sanitizat… | — | wordfence |
| WF-69885963 | coming-soon-countdown | MEDIUM | 6.1 | The Coming Soon Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and in… | — | wordfence |
| WF-698728b9 | apartment-management | MEDIUM | 6.1 | The WPAMS - Apartment Management System for wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting … | — | wordfence |
| WF-69711a11 | bulk-block-converter | MEDIUM | 6.1 | The Bulk Block Converter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and… | — | wordfence |
| WF-696960f4 | canvasflow | MEDIUM | 6.1 | The Canvasflow for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to,… | — | wordfence |
| WF-6966cf31 | lbg-universal-video-player-addon-visual-composer < 3.2.2.0 |
MEDIUM | 6.1 | The Universal Video Player - Addon for WPBakery Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site … | 3.2.2.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →