Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1071 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-5f6c53b5 | anac-xml-render | MEDIUM | 6.1 | The ANAC XML Render plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… | — | wordfence |
| WF-5f6b88fb | under-construction-maintenance-mode < 1.1.2 |
MEDIUM | 6.1 | The Under Construction, Coming Soon & Maintenance Mode plugin for WordPress is vulnerable to Server Side Request Forgery… | 1.1.2 | wordfence |
| WF-5f62045b | easy-appointments < 1.12.0 |
MEDIUM | 6.1 | The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings value in the admin panel. | 1.12.0 | wordfence |
| WF-5f59d905 | monetize | MEDIUM | 6.1 | The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-ne… | — | wordfence |
| WF-5f550bac | media-library-plus < 8.2.1 |
MEDIUM | 6.1 | The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in … | 8.2.1 | wordfence |
| WF-5f4d57e4 | mystickyelements < 2.0.4 |
MEDIUM | 6.1 | The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable … | 2.0.4 | wordfence |
| WF-5f21a86b | woo-pdf-invoice-builder < 1.2.137 |
MEDIUM | 6.1 | The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Reflected … | 1.2.137 | wordfence |
| WF-5f1e0dfa | clover-online-orders < 1.5.5 |
MEDIUM | 6.1 | The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to… | 1.5.5 | wordfence |
| WF-5f126296 | like-share-my-site | MEDIUM | 6.1 | The Like & Share My Site plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… | — | wordfence |
| WF-5efb2fbe | wtyczka-seopilot-dla-wp | MEDIUM | 6.1 | The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and … | — | wordfence |
| WF-5ef842ad | itracker360 < 2.2.1 |
MEDIUM | 6.1 | The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting … | 2.2.1 | wordfence |
| WF-5ef65205 | contact-form-entries < 1.5.3 |
MEDIUM | 6.1 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Reflected Cross-Site Scr… | 1.5.3 | wordfence |
| WF-5eeebd5f | share-this-image < 2.02 |
MEDIUM | 6.1 | The Share This Image plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includi… | 2.02 | wordfence |
| WF-5eeb40a0 | wplms | MEDIUM | 6.1 | The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to Reflected Cross-S… | — | wordfence |
| WF-5eeae0eb | imagerecycle-pdf-image-compression < 3.1.11 |
MEDIUM | 6.1 | … | 3.1.11 | wordfence |
| WF-5ee9183c | invelity-sps-connect | MEDIUM | 6.1 | The Invelity SPS connect plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inc… | — | wordfence |
| WF-5ee3416b | wp-backup-manager | MEDIUM | 6.1 | The WP Backup Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includ… | — | wordfence |
| WF-5ee19031 | product-blocks < 2.2.6 |
MEDIUM | 6.1 | ProductX – Gutenberg WooCommerce Blocks – WooCommerce Builder, Wishlist for WooCommerce, Products Comparison, Quick … | 2.2.6 | wordfence |
| WF-5ed9f7a1 | wp-walla | MEDIUM | 6.1 | The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all vers… | — | wordfence |
| WF-5ec1ce79 | wpcf7-redirect < 2.5.0 |
MEDIUM | 6.1 | The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it i… | 2.5.0 | wordfence |
| WF-5eba6825 | ecommerce-product-catalog < 3.0.39 |
MEDIUM | 6.1 | The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter… | 3.0.39 | wordfence |
| WF-5eb66ca3 | contact-form-plugin < 4.2.9 |
MEDIUM | 6.1 | The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm… | 4.2.9 | wordfence |
| WF-5eab077f | wplyrics | MEDIUM | 6.1 | The WP Lyrics plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4… | — | wordfence |
| WF-5e9ba1cb | contact-form-cfdb7 < 1.2.6.2 |
MEDIUM | 6.1 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 Wo… | 1.2.6.2 | wordfence |
| WF-5e95ded5 | qards | MEDIUM | 6.1 | The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2c… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →