Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1105 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-3d667f97 | chessgame-shizzle < 1.3.1 |
MEDIUM | 6.1 | The Chessgame Shizzle plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'cs_nonce' parameter … | 1.3.1 | wordfence |
| WF-3d6488ce | woo-order-export-lite < 3.1.8 |
MEDIUM | 6.1 | This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order da… | 3.1.8 | wordfence |
| WF-3d6199e1 | fraudlabs-pro-for-woocommerce < 2.22.9 |
MEDIUM | 6.1 | The FraudLabs Pro for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… | 2.22.9 | wordfence |
| WF-3d5c4bf6 | arya-multipurpose | MEDIUM | 6.1 | The Arya Multipurpose theme for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.0.5 … | — | wordfence |
| WF-3d599ed8 | nextgen-gallery-pro < 3.1.11 |
MEDIUM | 6.1 | In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_i… | 3.1.11 | wordfence |
| WF-3d55bee0 | easy-filter | MEDIUM | 6.1 | The Easy Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and includin… | — | wordfence |
| WF-3d501415 | email-subscriber | MEDIUM | 6.1 | The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sani… | — | wordfence |
| WF-3d4bb4b6 | aruba-hispeed-cache < 3.0.3 |
MEDIUM | 6.1 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter … | 3.0.3 | wordfence |
| WF-3d4838b8 | essential-breadcrumbs | MEDIUM | 6.1 | The Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1.… | — | wordfence |
| WF-3d400eae | debug-bar-extender | MEDIUM | 6.1 | The Debug-Bar-Extender plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inclu… | — | wordfence |
| WF-3d2f77cf | geoportail-shortcode | MEDIUM | 6.1 | The Geoportail Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… | — | wordfence |
| WF-3d2dde13 | wp-rss-aggregator < 5.0.11 |
MEDIUM | 6.1 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Refl… | 5.0.11 | wordfence |
| WF-3d2d22bb | bradesco-gateway | MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the W… | — | wordfence |
| WF-3d2031c4 | small-package-quotes-wwe-edition < 5.2.19 |
MEDIUM | 6.1 | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to Reflected Cross-Site Script… | 5.2.19 | wordfence |
| WF-3d1c009c | wp-user-frontend < 4.3.14 |
MEDIUM | 6.1 | The User Frontend plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and includ… | 4.3.14 | wordfence |
| WF-3d1513b5 | contribuinte-checkout < 2.0.04 |
MEDIUM | 6.1 | The Contribuinte Checkout plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in… | 2.0.04 | wordfence |
| WF-3d13454c | easyazon | MEDIUM | 6.1 | The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… | — | wordfence |
| WF-3d12d692 | webmention < 4.0.9 |
MEDIUM | 6.1 | The Webmention plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘replytocom’ parameter i… | 4.0.9 | wordfence |
| WF-3d0f5e62 | efence | MEDIUM | 6.1 | Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress… | — | wordfence |
| WF-3d0afaca | seguro-viagem < 3.0.0 |
MEDIUM | 6.1 | The Real Seguro Viagem plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… | 3.0.0 | wordfence |
| WF-3d065c2a | sassy-social-share < 3.3.70 |
MEDIUM | 6.1 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting vi… | 3.3.70 | wordfence |
| WF-3d0114d9 | photo-express-for-google | MEDIUM | 6.1 | The Photo Express for Google plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and… | — | wordfence |
| WF-3cdf6ba0 | dream-gallery | MEDIUM | 6.1 | The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… | — | wordfence |
| WF-3cde6acf | xili-language < 2.21.3 |
MEDIUM | 6.1 | The xili-language plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including,… | 2.21.3 | wordfence |
| WF-3cdad887 | webcamconsult < 1.6.0 |
MEDIUM | 6.1 | The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… | 1.6.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →