Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1081 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-5580e3b7 | leads-crm | MEDIUM | 6.1 | The Leads CRM plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.0… | — | wordfence |
| WF-5579957a | my-auctions-allegro-free-edition < 4.0.3 |
MEDIUM | 6.1 | The My auctions allegro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and incl… | 4.0.3 | wordfence |
| WF-55773c6c | flash-album-gallery < 1.57 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.5… | 1.57 | wordfence |
| WF-5570b8ef | sendpress < 1.2 |
MEDIUM | 6.1 | The SendPress Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'listID' & 'subsc… | 1.2 | wordfence |
| WF-556f6e7d | 4-author-cheer-up-donate | MEDIUM | 6.1 | The 4 author cheer up donate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to,… | — | wordfence |
| WF-5569ec0f | velvet | MEDIUM | 6.1 | The Velvet Theme for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions … | — | wordfence |
| WF-5537c46d | singsong | MEDIUM | 6.1 | The SingSong plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.… | — | wordfence |
| WF-55367b9b | admission-appmanager | MEDIUM | 6.1 | The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in v… | — | wordfence |
| WF-552d2d0d | wyzi-business-finder < 2.4.3 |
MEDIUM | 6.1 | The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature | 2.4.3 | wordfence |
| WF-550a8107 | simple-custom-website-data | MEDIUM | 6.1 | The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in t… | — | wordfence |
| WF-54fff686 | thebe | MEDIUM | 6.1 | The Thebe theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.0 du… | — | wordfence |
| WF-54e7ccaf | church-admin < 0.810 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers t… | 0.810 | wordfence |
| WF-54e330e7 | forms-ada-form-builder | MEDIUM | 6.1 | The Forms Ada plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘p’ ($page_nav) parameter… | — | wordfence |
| WF-54def910 | studiocart | MEDIUM | 6.1 | The Studiocart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.… | — | wordfence |
| WF-54c79532 | enable-media-replace < 4.1.6 |
MEDIUM | 6.1 | The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inc… | 4.1.6 | wordfence |
| WF-54c563fb | vice-versa | MEDIUM | 6.1 | The Vice Versa plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.… | — | wordfence |
| WF-54c38be0 | simple-urls < 118 |
MEDIUM | 6.1 | The Simple URLs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in vers… | 118 | wordfence |
| WF-54c1809d | json-structuring-markup | MEDIUM | 6.1 | The JSON Structuring Markup plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and … | — | wordfence |
| WF-54c154a9 | connections < 0.7.1.6 |
MEDIUM | 6.1 | The Connections plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 0.7.1.5 due… | 0.7.1.6 | wordfence |
| WF-54c0146d | twispay | MEDIUM | 6.1 | The Twispay Credit Card Payments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to,… | — | wordfence |
| WF-54b88702 | cloudnet-sync | MEDIUM | 6.1 | The CloudNet360 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all ver… | — | wordfence |
| WF-54ac4a5a | theme-blvd-sliders | MEDIUM | 6.1 | The Theme Blvd Sliders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inclu… | — | wordfence |
| WF-54a5146e | wp-block-pack | MEDIUM | 6.1 | The Block Collection for You – WP Block Pack plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in a… | — | wordfence |
| WF-549d4aa4 | accordion_slider_pro | MEDIUM | 6.1 | The Accordion Slider PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inc… | — | wordfence |
| WF-54904fb0 | automotive | MEDIUM | 6.1 | The Automotive Car Dealership Business WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripti… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →