Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1187 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-90ebe593 | wp-sms < 5.4.13 |
MEDIUM | 5.5 | The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in t… | 5.4.13 | wordfence |
| WF-90c0eb3e | miniorange-2-factor-authentication < 5.5.6 |
MEDIUM | 5.5 | The miniOrange's Google Authenticator plugin for WordPress vulnerable to Stored Cross-Site Scripting via the ‘Add Refe… | 5.5.6 | wordfence |
| WF-90706a16 | fancier-author-box | MEDIUM | 5.5 | The Fancier Author Box by ThematoSoup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin s… | — | wordfence |
| WF-90333dc7 | archivist-custom-archive-templates < 1.7.5 |
MEDIUM | 5.5 | The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin s… | 1.7.5 | wordfence |
| WF-9016822f | sg-helper | MEDIUM | 5.5 | The SG Helper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.0 due … | — | wordfence |
| WF-8fed0fae | wp-webinarsystem < 1.33.31 |
MEDIUM | 5.5 | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all v… | 1.33.31 | wordfence |
| WF-8f896e4a | wordpress < 2.2.2 |
MEDIUM | 5.5 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inje… | 2.2.2 | wordfence |
| WF-8ee21796 | wp-user | MEDIUM | 5.5 | The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up… | — | wordfence |
| WF-8eda641b | car-rental | MEDIUM | 5.5 | The Car Rental by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter… | — | wordfence |
| WF-8ebc05b6 | booking-calendar < 2.1.8 |
MEDIUM | 5.5 | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_… | 2.1.8 | wordfence |
| WF-8eaf6dfd | maxbuttons < 9.3 |
MEDIUM | 5.5 | The MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.2 d… | 9.3 | wordfence |
| WF-8e73b00e | blossomthemes-email-newsletter < 2.2.7 |
MEDIUM | 5.5 | The BlossomThemes Email Newsletter plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up … | 2.2.7 | wordfence |
| WF-8e5c0282 | aio-time-clock-lite < 1.3.321 |
MEDIUM | 5.5 | The All in One Time Clok Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's setting… | 1.3.321 | wordfence |
| WF-8e33d72d | igniteup < 3.4.2 |
MEDIUM | 5.5 | The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't hav… | 3.4.2 | wordfence |
| WF-8e25a511 | curtain | MEDIUM | 5.5 | The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high pri… | — | wordfence |
| WF-8e04769b | broken-link-checker < 2.4.2 |
MEDIUM | 5.5 | The Broken Link Checker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inc… | 2.4.2 | wordfence |
| WF-8dda7b14 | affiliate-toolkit-starter < 3.3.4 |
MEDIUM | 5.5 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… | 3.3.4 | wordfence |
| WF-8dbaed2a | rock-convert < 2.11.0 |
MEDIUM | 5.5 | The Rock Convert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘text’ field on the setti… | 2.11.0 | wordfence |
| WF-8cec5695 | litespeed-cache < 3.6.1 |
MEDIUM | 5.5 | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via… | 3.6.1 | wordfence |
| WF-8ce350cb | company-updates-for-linkedin | MEDIUM | 5.5 | The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high pri… | — | wordfence |
| WF-8cde404a | admin-menu-groups | MEDIUM | 5.5 | The Admin Menu Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including… | — | wordfence |
| WF-8cb4a14a | backup-backup < 1.1.6 |
MEDIUM | 5.5 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1… | 1.1.6 | wordfence |
| WF-8cac4bde | mp-restaurant-menu < 2.4.2 |
MEDIUM | 5.5 | The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating… | 2.4.2 | wordfence |
| WF-8c755b87 | wp-admin-style | MEDIUM | 5.5 | The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow h… | — | wordfence |
| WF-8c74d5ad | grand-media < 1.20.0 |
MEDIUM | 5.5 | The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting … | 1.20.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →