Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1113 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-362fcd02 | redline < 1.66 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to injec… | 1.66 | wordfence |
| WF-360fee18 | woocommerce-photo-reviews | MEDIUM | 6.1 | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versio… | — | wordfence |
| WF-360cb170 | unnamed-se < 1.0.3 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme before 1.2.17.1, and Special Edition (SE) 1.0… | 1.0.3 | wordfence |
| WF-360cb170 | unnamed < 1.2.17.1 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme before 1.2.17.1, and Special Edition (SE) 1.0… | 1.2.17.1 | wordfence |
| WF-35fb04aa | supportcandy < 2.2.7 |
MEDIUM | 6.1 | The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back i… | 2.2.7 | wordfence |
| WF-35f9f778 | wp-photo-album-plus < 8.8.00.003 |
MEDIUM | 6.1 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and incl… | 8.8.00.003 | wordfence |
| WF-35f49283 | wp-perfect-plugin < 1.8.6 |
MEDIUM | 6.1 | The W3P SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.5… | 1.8.6 | wordfence |
| WF-35d69a35 | social-count-plus < 3.0.3 |
MEDIUM | 6.1 | The Social Count Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includ… | 3.0.3 | wordfence |
| WF-35d64d3e | clover-online-orders < 1.5.8 |
MEDIUM | 6.1 | The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of… | 1.5.8 | wordfence |
| WF-35c7c089 | eventprime-event-calendar-management < 4.0.4.6 |
MEDIUM | 6.1 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Open Redirect in all vers… | 4.0.4.6 | wordfence |
| WF-35c608c3 | weaver-for-bbpress < 1.7.1 |
MEDIUM | 6.1 | The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpno… | 1.7.1 | wordfence |
| WF-35b6a26a | wpforo < 2.1.9 |
MEDIUM | 6.1 | The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforo_debug’ functio… | 2.1.9 | wordfence |
| WF-35b5a6ab | wp-live-chat-support < 8.0.27 |
MEDIUM | 6.1 | The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. | 8.0.27 | wordfence |
| WF-35b013c1 | h5p-css-editor | MEDIUM | 6.1 | The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found… | — | wordfence |
| WF-35a0f4dd | icons-for-features < 1.0.1 |
MEDIUM | 6.1 | The Icons for Features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_… | 1.0.1 | wordfence |
| WF-359e9b04 | kiotvietsync | MEDIUM | 6.1 | The KiotViet Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… | — | wordfence |
| WF-359b8977 | coming-soon-maintenance-mode-from-acurax | MEDIUM | 6.1 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Cross-Site Scripting via an … | — | wordfence |
| WF-35896489 | crius | MEDIUM | 6.1 | The Covert VideoPress Theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to inclusion of a vulnerab… | — | wordfence |
| WF-357bbb87 | pepro-cf7-database | MEDIUM | 6.1 | The PeproDev CF7 Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and i… | — | wordfence |
| WF-35790e70 | woo-product-table < 5.0.9 |
MEDIUM | 6.1 | The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_k… | 5.0.9 | wordfence |
| WF-35707e4e | wc-sms < 2.8.1.1 |
MEDIUM | 6.1 | The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… | 2.8.1.1 | wordfence |
| WF-3563f70d | spideranalyse | MEDIUM | 6.1 | The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~… | — | wordfence |
| WF-35609838 | legull | MEDIUM | 6.1 | The Legull plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.… | — | wordfence |
| WF-3553044e | cooked-pro < 1.7.5.6 |
MEDIUM | 6.1 | The Cooked Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.… | 1.7.5.6 | wordfence |
| WF-354c2c6c | modula-best-grid-gallery < 2.6.7 |
MEDIUM | 6.1 | The Modula Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer… | 2.6.7 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →