Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1102 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-4052adde | bet-wc-2018-russia | MEDIUM | 6.1 | The Bet WC 2018 Russia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inclu… | — | wordfence |
| WF-404aabc5 | wp-all-import-pro < 4.1.1 |
MEDIUM | 6.1 | The WP All Import Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in v… | 4.1.1 | wordfence |
| WF-40494f1e | jannah < 5.4.5 |
MEDIUM | 6.1 | The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX… | 5.4.5 | wordfence |
| WF-40371178 | wp-simple-redirect | MEDIUM | 6.1 | The Simple Redirect plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includin… | — | wordfence |
| WF-401f5d57 | wysija-newsletters < 2.1.7 |
MEDIUM | 6.1 | The Wysija Newsletters plugin for WordPress is vulnerable to Cross-Site Scripting via the swfupload.swf applet in versio… | 2.1.7 | wordfence |
| WF-401e2201 | vertical-diamond-flipbook-flash | MEDIUM | 6.1 | The Nature FlipBook WordPress Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all version… | — | wordfence |
| WF-401da94d | simple-finance-calculator | MEDIUM | 6.1 | The Simple Finance Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, an… | — | wordfence |
| WF-4013a22a | eelv-newsletter < 3.3.1 |
MEDIUM | 6.1 | The EELV Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter in ve… | 3.3.1 | wordfence |
| WF-400d31ba | jnews < 8.0.6 |
MEDIUM | 6.1 | The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (w… | 8.0.6 | wordfence |
| WF-4007814b | stripe-gateway < 2.1.3 |
MEDIUM | 6.1 | The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.1… | 2.1.3 | wordfence |
| WF-3fffe8f2 | vkontakte-wall-post | MEDIUM | 6.1 | The VKontakte Wall Post plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin… | — | wordfence |
| WF-3ffd63ca | tainacan-interface < 2.7.3 |
MEDIUM | 6.1 | The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of ad… | 2.7.3 | wordfence |
| WF-3fe91c7e | payflex-payment-gateway < 2.6.2 |
MEDIUM | 6.1 | The Payflex Payment Gateway plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.… | 2.6.2 | wordfence |
| WF-3fddf493 | wp-simple-slideshow | MEDIUM | 6.1 | The WP Simple Slideshow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and incl… | — | wordfence |
| WF-3fc962d7 | all-in-one-contentslider | MEDIUM | 6.1 | The LambertGroup - AllInOne - Content Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in ver… | — | wordfence |
| WF-3fc752bb | sandbox | MEDIUM | 6.1 | The Sandbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'debug' parameter in all versio… | — | wordfence |
| WF-3fc04d8a | foogallery < 2.4.30 |
MEDIUM | 6.1 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnera… | 2.4.30 | wordfence |
| WF-3fb46633 | woo-line-notify | MEDIUM | 6.1 | The Woocommerce Line Notify plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, … | — | wordfence |
| WF-3fa63ac2 | jobica-core < 1.4.2 |
MEDIUM | 6.1 | The Jobica Core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1… | 1.4.2 | wordfence |
| WF-3f8321a7 | stock-ticker < 3.23.3 |
MEDIUM | 6.1 | The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_symbol_sea… | 3.23.3 | wordfence |
| WF-3f594989 | order-xml-file-export-import-for-woocommerce < 1.2.3 |
MEDIUM | 6.1 | The Order XML File Export Import for WooCommerce Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting vi… | 1.2.3 | wordfence |
| WF-3f5413be | custom-metas | MEDIUM | 6.1 | The Custom Metas plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘/wp-content/plugins/cus… | — | wordfence |
| WF-3f39c478 | optinmonster < 2.6.1 |
MEDIUM | 6.1 | The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation i… | 2.6.1 | wordfence |
| WF-3f3448ad | glass | MEDIUM | 6.1 | The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a pa… | — | wordfence |
| WF-3f18a07f | dj-email-publish | MEDIUM | 6.1 | The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SE… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →