Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1184 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-a741446e | slider-wd < 1.2.52 |
MEDIUM | 5.5 | The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could… | 1.2.52 | wordfence |
| WF-a6b0b516 | reamaze < 2.0 |
MEDIUM | 5.5 | The Re:amaze Helpdesk & Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several paramete… | 2.0 | wordfence |
| WF-a62a3a71 | wpematico < 2.6.12 |
MEDIUM | 5.5 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before ou… | 2.6.12 | wordfence |
| WF-a5985318 | wp-google-places-review-slider < 11.6 |
MEDIUM | 5.5 | The WP Google Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inc… | 11.6 | wordfence |
| WF-a4f4605c | wp-pipes | MEDIUM | 5.5 | The WP Pipes plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4… | — | wordfence |
| WF-a4c0b14a | multi-functional-flexi-lightbox | MEDIUM | 5.5 | The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `arv_lb[me… | — | wordfence |
| WF-a4aea6ac | donorbox-donation-form < 7.1.7 |
MEDIUM | 5.5 | The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it i… | 7.1.7 | wordfence |
| WF-a4a885e0 | blocksy-companion < 2.0.43 |
MEDIUM | 5.5 | The Blocksy Companion plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inclu… | 2.0.43 | wordfence |
| WF-a44ce6a3 | mega_main_menu | MEDIUM | 5.5 | The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters… | — | wordfence |
| WF-a3232aaa | activecampaign-subscription-forms < 8.1.15 |
MEDIUM | 5.5 | The ActiveCampaign – Forms, Site Tracking, Live Chat plugin for WordPress is vulnerable to Server-Side Request Forgery… | 8.1.15 | wordfence |
| WF-a27cfa5a | newsletter < 7.4.6 |
MEDIUM | 5.5 | The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the preheader_text value in version… | 7.4.6 | wordfence |
| WF-a246227c | rss-for-yandex-turbo < 1.31 |
MEDIUM | 5.5 | The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving an… | 1.31 | wordfence |
| WF-a18baa1d | chaty < 3.1.9 |
MEDIUM | 5.5 | … | 3.1.9 | wordfence |
| WF-a12f1061 | gravity-forms-css-themes-with-fontawesome-and-placeholder-support | MEDIUM | 5.5 | The Gravity Forms CSS Themes with Fontawesome and Placeholders plugin for WordPress is vulnerable to Stored Cross-Site S… | — | wordfence |
| WF-a107839e | wp-travel-engine < 5.3.1 |
MEDIUM | 5.5 | The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activit… | 5.3.1 | wordfence |
| WF-a07ca145 | ad-injection | MEDIUM | 5.5 | The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the … | — | wordfence |
| WF-a07bd233 | oauth2-provider < 4.2.2 |
MEDIUM | 5.5 | The WP OAuth Server plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the client ID parameter in ver… | 4.2.2 | wordfence |
| WF-a03f0780 | download-monitor < 4.8.2 |
MEDIUM | 5.5 | The Download Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including,… | 4.8.2 | wordfence |
| WF-a018ba2b | easy-form-builder < 3.4.0 |
MEDIUM | 5.5 | The Easy Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including… | 3.4.0 | wordfence |
| WF-9fe2a19a | simplified < 1.0.12 |
MEDIUM | 5.5 | The Simplified Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inclu… | 1.0.12 | wordfence |
| WF-9fae8288 | ag-custom-admin < 7.2.4 |
MEDIUM | 5.5 | The AGCA – Custom Dashboard & Login Page plugin for WordPress is vulnerable to Server-Side Request Forgery in all vers… | 7.2.4 | wordfence |
| WF-9f76e294 | login-with-phone-number < 1.3.8 |
MEDIUM | 5.5 | The Login with phone number WordPress plugin through 1.3.7 do not sanitise and escape plugin settings which could allow … | 1.3.8 | wordfence |
| WF-9f6fd068 | mjm-clinic < 1.1.23 |
MEDIUM | 5.5 | The MJM Clinic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and… | 1.1.23 | wordfence |
| WF-9f699d49 | instagram-slider-widget < 2.0.7 |
MEDIUM | 5.5 | The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hashtag parameter in ve… | 2.0.7 | wordfence |
| WF-9f5a77d1 | reaction-buttons | MEDIUM | 5.5 | The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →