Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1092 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-4b4369f8 | spiffy-calendar < 4.9.10 |
MEDIUM | 6.1 | The Spiffy Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and incl… | 4.9.10 | wordfence |
| WF-4b430f98 | woocommerce-germanized < 3.9.5 |
MEDIUM | 6.1 | The Germanized for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of ad… | 3.9.5 | wordfence |
| WF-4b41a736 | wp-secure-by-sitesecuritymonitorcom | MEDIUM | 6.1 | The wp secure plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including,… | — | wordfence |
| WF-4b32cfa8 | azonpost | MEDIUM | 6.1 | The AzonPost plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `editpos_hidden` parameter in … | — | wordfence |
| WF-4b2fa6c3 | wp-post-corrector | MEDIUM | 6.1 | The WP Post Corrector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includ… | — | wordfence |
| WF-4b2eb0e8 | goto < 2.0 |
MEDIUM | 6.1 | The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, l… | 2.0 | wordfence |
| WF-4b27a6e6 | wp-login-with-ajax | MEDIUM | 6.1 | The Wp Login with Ajax plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… | — | wordfence |
| WF-4b0aa44f | wp-email-delivery | MEDIUM | 6.1 | The WP Email Delivery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and in… | — | wordfence |
| WF-4b096abd | shiptimize-for-woocommerce | MEDIUM | 6.1 | The Shiptimize for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up t… | — | wordfence |
| WF-4afb25d5 | yikes-inc-easy-mailchimp-extender < 6.8.9 |
MEDIUM | 6.1 | The Easy Forms for Mailchimp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql_error' pa… | 6.8.9 | wordfence |
| WF-4ad45c7b | aryo-activity-log < 2.3.3 |
MEDIUM | 6.1 | The aryo-activity-log plugin before 2.3.3 for WordPress has XSS in the search_data parameter in the aryo-activity-log/cl… | 2.3.3 | wordfence |
| WF-4ac71fdb | serped-net < 4.7 |
MEDIUM | 6.1 | The SERPed.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.… | 4.7 | wordfence |
| WF-4ac68b80 | simple-mail-address-encoder < 1.7 |
MEDIUM | 6.1 | The Simple Mail Address Encoder plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions before… | 1.7 | wordfence |
| WF-4ab78b31 | imagemeta | MEDIUM | 6.1 | The ImageMeta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including,… | — | wordfence |
| WF-4aad3bc3 | z-inventory-manager < 3.1.6 |
MEDIUM | 6.1 | The PlainInventory – Inventory Management Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting … | 3.1.6 | wordfence |
| WF-4aa9387d | clipart | MEDIUM | 6.1 | The ClipArt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0… | — | wordfence |
| WF-4aa0e496 | quick-contact-form < 8.2.2 |
MEDIUM | 6.1 | The Quick Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and i… | 8.2.2 | wordfence |
| WF-4a9fce6d | post-pay-counter < 2.790 |
MEDIUM | 6.1 | The Post Pay Counter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'orderby' parameter in… | 2.790 | wordfence |
| WF-4a9df582 | companion-sitemap-generator < 4.5.3 |
MEDIUM | 6.1 | … | 4.5.3 | wordfence |
| WF-4a984bd8 | thanks-you-counter-button | MEDIUM | 6.1 | Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.9.3 for WordPress allow rem… | — | wordfence |
| WF-4a85de70 | interactive-medical-drawing-of-human-body < 2.6 |
MEDIUM | 6.1 | The Interactive Medical Drawing of Human Body plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via t… | 2.6 | wordfence |
| WF-4a71fda4 | woocommerce-subscriptions < 2.6.3 |
MEDIUM | 6.1 | Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arb… | 2.6.3 | wordfence |
| WF-4a66b704 | listify | MEDIUM | 6.1 | The Listify theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.2.5 … | — | wordfence |
| WF-4a4d58f3 | sonaar < 4.27.5 |
MEDIUM | 6.1 | The Sonaar theme for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.2… | 4.27.5 | wordfence |
| WF-4a3f1e3d | first-comment-redirect | MEDIUM | 6.1 | The First Comment Redirect plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, a… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →