Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1192 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-6c3f4796 | vikbooking < 1.5.9 |
MEDIUM | 5.5 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high… | 1.5.9 | wordfence |
| WF-6c240829 | wp-auctions | MEDIUM | 5.5 | The WordPress Auction Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and in… | — | wordfence |
| WF-6bfdf424 | broken-link-checker < 2.4.14.1 |
MEDIUM | 5.5 | The Broken Link Checker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inc… | 2.4.14.1 | wordfence |
| WF-6bf7a5c3 | easy-media-gallery < 1.2.29 |
MEDIUM | 5.5 | The Gallery – Photo Albums (formerly titled Easy Media Gallery) Plugin for WordPress is vulnerable to Stored Cross-Sit… | 1.2.29 | wordfence |
| WF-6bdd1817 | simple-comment-editing < 3.1.0 |
MEDIUM | 5.5 | The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Server-Side Request Forgery in al… | 3.1.0 | wordfence |
| WF-6b5964a7 | nex-forms-express-wp-form-builder < 8.5.6 |
MEDIUM | 5.5 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Inject… | 8.5.6 | wordfence |
| WF-6b2e61aa | jobboardwp < 1.1.0 |
MEDIUM | 5.5 | The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sa… | 1.1.0 | wordfence |
| WF-6af83daa | wordpress < 3.7.31 |
MEDIUM | 5.5 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. | 3.7.31 | wordfence |
| WF-6abde5cf | ajax-search-lite < 4.12.1 |
MEDIUM | 5.5 | The Ajax Search Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version… | 4.12.1 | wordfence |
| WF-6a595b3c | automatic-youtube-video-posts | MEDIUM | 5.5 | The Automatic Youtube Video Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin set… | — | wordfence |
| WF-6a44a55e | wp-useronline < 2.88.0 |
MEDIUM | 5.5 | The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][t… | 2.88.0 | wordfence |
| WF-69cf2f28 | auto-upload-images < 3.3.1 |
MEDIUM | 5.5 | The WordPress Auto Upload Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameter… | 3.3.1 | wordfence |
| WF-69971673 | http-headers < 1.19.0 |
MEDIUM | 5.5 | The HTTP Headers plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1… | 1.19.0 | wordfence |
| WF-6972f776 | social-media-feather < 2.0.5 |
MEDIUM | 5.5 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versio… | 2.0.5 | wordfence |
| WF-69693a9a | event-list < 0.8.8 |
MEDIUM | 5.5 | The Event List WordPress plugin through 0.8.8 does not sanitise and escape some of its settings, allowing high privilege… | 0.8.8 | wordfence |
| WF-6935bca8 | google-places-reviews < 2.0.0 |
MEDIUM | 5.5 | The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is re… | 2.0.0 | wordfence |
| WF-6904f168 | featured-image-plus < 1.6.7 |
MEDIUM | 5.5 | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Fo… | 1.6.7 | wordfence |
| WF-68ec28e8 | chained-quiz < 1.3.2.6 |
MEDIUM | 5.5 | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3… | 1.3.2.6 | wordfence |
| WF-68d7b5d0 | wplegalpages < 2.9.3 |
MEDIUM | 5.5 | The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versio… | 2.9.3 | wordfence |
| WF-68d44dd9 | scrollrevealjs-effects | MEDIUM | 5.5 | The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow hi… | — | wordfence |
| WF-6867d573 | th23-social | MEDIUM | 5.5 | The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high… | — | wordfence |
| WF-68394503 | tutor < 2.7.3 |
MEDIUM | 5.5 | The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.2 … | 2.7.3 | wordfence |
| WF-67b5d20b | great-quotes | MEDIUM | 5.5 | The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, … | — | wordfence |
| WF-67953bf3 | simple-banner < 2.12.0 |
MEDIUM | 5.5 | The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing h… | 2.12.0 | wordfence |
| WF-674df25e | popad | MEDIUM | 5.5 | The PopAd plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.4.… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →