Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1064 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-675b029a | dzs-videogallery < 7.95 |
MEDIUM | 6.1 | Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress … | 7.95 | wordfence |
| WF-6753a37b | mycred < 2.4 |
MEDIUM | 6.1 | The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the hi… | 2.4 | wordfence |
| WF-6745be2e | ht-mega-for-elementor < 2.3.9 |
MEDIUM | 6.1 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via t… | 2.3.9 | wordfence |
| WF-6728fca7 | address-bar-ads | MEDIUM | 6.1 | The Address Bar Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL Path in all version… | — | wordfence |
| WF-671fe004 | houzez < 4.4.1 |
MEDIUM | 6.1 | The Houzez theme for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.4… | 4.4.1 | wordfence |
| WF-6714ccff | yellow-pencil-visual-theme-customizer < 7.6.4 |
MEDIUM | 6.1 | The Visual CSS Style Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, … | 7.6.4 | wordfence |
| WF-67147f28 | prestige < 1.4.1 |
MEDIUM | 6.1 | The Prestige theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to 1.4.1 due to insuffic… | 1.4.1 | wordfence |
| WF-670efa9a | passwordless-wp | MEDIUM | 6.1 | The Passwordless WP – Login with your glance or fingerprint plugin for WordPress is vulnerable to Reflected Cross-Site… | — | wordfence |
| WF-6702c762 | json-rest-api < 1.2.3 |
MEDIUM | 6.1 | The WP REST API plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.2.2 due t… | 1.2.3 | wordfence |
| WF-67008179 | mailster < 4.0.10 |
MEDIUM | 6.1 | The Mailster plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.0.… | 4.0.10 | wordfence |
| WF-66ed3f4d | wp-jobs < 1.7 |
MEDIUM | 6.1 | The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field. | 1.7 | wordfence |
| WF-66c7c6d1 | seo-automatic-seo-tools | MEDIUM | 6.1 | The SEO Tools plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.0… | — | wordfence |
| WF-66c49614 | real-time-validation-for-gravity-forms | MEDIUM | 6.1 | The Real Time Validation for Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versi… | — | wordfence |
| WF-66bca09b | audio-video-download-buttons-for-youtube < 1.04 |
MEDIUM | 6.1 | The Download buttons for Youtube videos plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions… | 1.04 | wordfence |
| WF-66b6443a | no-page-comment < 1.2 |
MEDIUM | 6.1 | The No Page Comment plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'], wh… | 1.2 | wordfence |
| WF-66b279f3 | maniac-seo | MEDIUM | 6.1 | The Maniac SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including… | — | wordfence |
| WF-66a65270 | royal-slider < 3.2.7 |
MEDIUM | 6.1 | The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. | 3.2.7 | wordfence |
| WF-66a3346c | porto | MEDIUM | 6.1 | The Porto theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.6.2 du… | — | wordfence |
| WF-66a2a159 | woo-email-control < 1.02 |
MEDIUM | 6.1 | The Woo Email Control plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘recipient’ param… | 1.02 | wordfence |
| WF-669fa0eb | wp_visitorstracker < 2.4 |
MEDIUM | 6.1 | The WP Visitors Tracker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and … | 2.4 | wordfence |
| WF-66950509 | wp-blockade | MEDIUM | 6.1 | The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in al… | — | wordfence |
| WF-668afa62 | post-grid < 2.1.16 |
MEDIUM | 6.1 | The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it … | 2.1.16 | wordfence |
| WF-66717800 | participants-database < 1.7.5.10 |
MEDIUM | 6.1 | The Participants Database plugin for WordPress is vulnerable to Cross-Site Scripting via the 'Name' paremeter in version… | 1.7.5.10 | wordfence |
| WF-6662c336 | q2w3-inc-manager | MEDIUM | 6.1 | The Code Insert Manager (Q2W3 Inc Manager) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all v… | — | wordfence |
| WF-6654094f | essential-wp-real-estate | MEDIUM | 6.1 | The Essential WP Real Estate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of URLs… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →