Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1161 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-08033270 | bulletin-announcements < 3.12 |
MEDIUM | 6.1 | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… | 3.12 | wordfence |
| WF-07fa22aa | root-cookie | MEDIUM | 6.1 | The root Cookie plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… | — | wordfence |
| WF-07f25481 | simpleform-contact-form-submissions | MEDIUM | 6.1 | The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the … | — | wordfence |
| WF-07ede585 | member-database | MEDIUM | 6.1 | The Membership Database plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and incl… | — | wordfence |
| WF-07e9ae6a | gotmls < 4.21.83 |
MEDIUM | 6.1 | The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… | 4.21.83 | wordfence |
| WF-07d1c715 | crafty-social-buttons < 1.5.8 |
MEDIUM | 6.1 | The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS via several parameters. | 1.5.8 | wordfence |
| WF-07b48c64 | jobboardwp < 1.3.1 |
MEDIUM | 6.1 | The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripti… | 1.3.1 | wordfence |
| WF-07b1efbd | sfwd-lms < 3.1.2 |
MEDIUM | 6.1 | The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field. | 3.1.2 | wordfence |
| WF-07aeed92 | icegram < 2.0.5 |
MEDIUM | 6.1 | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitize and escape th… | 2.0.5 | wordfence |
| WF-07a357f4 | webd-woocommerce-product-excel-importer-bulk-edit | MEDIUM | 6.1 | The Product Excel Import Export & Bulk Edit for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site S… | — | wordfence |
| WF-07a0ffbe | uncode < 2.9.4.4 |
MEDIUM | 6.1 | The Uncode theme for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to 2.9.4.4 (exclusive)… | 2.9.4.4 | wordfence |
| WF-079f6ade | intelligent-importer < 5.1.4 |
MEDIUM | 6.1 | The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all vers… | 5.1.4 | wordfence |
| WF-079c77f1 | posti-shipping < 3.10.4 |
MEDIUM | 6.1 | The Posti Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the account_number and secre… | 3.10.4 | wordfence |
| WF-078ddf47 | fb-status-updater | MEDIUM | 6.1 | The Status Updater plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and inclu… | — | wordfence |
| WF-078b58df | simple-file-list < 6.1.13 |
MEDIUM | 6.1 | The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up t… | 6.1.13 | wordfence |
| WF-077a8f33 | progressify | MEDIUM | 6.1 | The Progressify - Progressive Web App (PWA) plugin for WordPress is vulnerable to Cross-Site Scripting in all versions u… | — | wordfence |
| WF-077538e2 | wp-bibtex < 3.0.2 |
MEDIUM | 6.1 | The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0… | 3.0.2 | wordfence |
| WF-075e64fb | mailpoet < 3.23.2 |
MEDIUM | 6.1 | The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using ext… | 3.23.2 | wordfence |
| WF-0753e172 | wp-e-commerce < 3.8.9.1 |
MEDIUM | 6.1 | The WP eCommerce plugin for WordPress is vulnerable to Cross-Site Scripting via the 'm' parameter in versions up to, and… | 3.8.9.1 | wordfence |
| WF-07534aa5 | wp-mail-catcher < 2.1.10 |
MEDIUM | 6.1 | The WP Mail Catcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includin… | 2.1.10 | wordfence |
| WF-074d8ccc | kvcore-idx | MEDIUM | 6.1 | The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the … | — | wordfence |
| WF-074c95bb | bb-plugin < 2.11.0.2 |
MEDIUM | 6.1 | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no… | 2.11.0.2 | wordfence |
| WF-072fbfe7 | pool < 1.1 |
MEDIUM | 6.1 | The Pool theme for WordPress is vulnerable to Reflected Cross-Site Scripting via PATH_INFO (PHP_SELF) in versions up to,… | 1.1 | wordfence |
| WF-0719db26 | whydowork-adsense | MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to in… | — | wordfence |
| WF-0716471e | chaty < 2.8.3 |
MEDIUM | 6.1 | The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the searc… | 2.8.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →