Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1196 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-4dcb4afc | tutor < 2.7.4 |
MEDIUM | 5.5 | The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.3 … | 2.7.4 | wordfence |
| WF-4dbba653 | zeno-font-resizer < 1.8.0 |
MEDIUM | 5.5 | The Zeno Font Resizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions u… | 1.8.0 | wordfence |
| WF-4d8d15be | user-language-switch | MEDIUM | 5.5 | The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and in… | — | wordfence |
| WF-4cf2af62 | ninja-forms-webhooks < 3.0.8 |
MEDIUM | 5.5 | The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and in… | 3.0.8 | wordfence |
| WF-4c2a88c3 | td-composer < 4.9 |
MEDIUM | 5.5 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module i… | 4.9 | wordfence |
| WF-4bd16698 | seo-backlink-monitor | MEDIUM | 5.5 | The SEO Backlink Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and in… | — | wordfence |
| WF-4baf9b27 | page-generator < 1.6.6 |
MEDIUM | 5.5 | The Page Generator plugin is vulnerable to Cross-Site Scripting in versions up to, and including, 1.6.4. This allows aut… | 1.6.6 | wordfence |
| WF-4ba416c5 | codup-woocommerce-dynamic-pricing-table-view < 1.2.1.5 |
MEDIUM | 5.5 | The Codup WooCommerce Dynamic Pricing Table View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via s… | 1.2.1.5 | wordfence |
| WF-4ba3b414 | wp-commentnavi < 1.12.2 |
MEDIUM | 5.5 | The WP-CommentNavi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the navi options 'pages_text', … | 1.12.2 | wordfence |
| WF-4b9741c6 | booking-calendar < 2.1.8 |
MEDIUM | 5.5 | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_f… | 2.1.8 | wordfence |
| WF-4a5262d8 | sticky-popup | MEDIUM | 5.5 | The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in… | — | wordfence |
| WF-4939b053 | miniorange-wp-as-saml-idp < 1.13.4 |
MEDIUM | 5.5 | The Login using WordPress Users (WP as SAML IDP) plugin by MiniOrange is vulnerable to Cross-Site Scripting in versions … | 1.13.4 | wordfence |
| WF-49023c6b | chained-quiz < 1.3.3 |
MEDIUM | 5.5 | The Chained Quiz plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,… | 1.3.3 | wordfence |
| WF-4890ec6f | ultimate-member < 2.0.46 |
MEDIUM | 5.5 | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several of the plugin's fo… | 2.0.46 | wordfence |
| WF-48758ada | accordions < 2.2.43 |
MEDIUM | 5.5 | The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameter keys through accordion imp… | 2.2.43 | wordfence |
| WF-47f04985 | filebird < 5.6.1 |
MEDIUM | 5.5 | The FileBird plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported folder titles in all version… | 5.6.1 | wordfence |
| WF-47a99115 | seed-social < 2.0.3 |
MEDIUM | 5.5 | The Seed Social plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Facebook App Id and App Secret… | 2.0.3 | wordfence |
| WF-472a98fe | nextcellent-gallery-nextgen-legacy < 1.9.18 |
MEDIUM | 5.5 | Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for… | 1.9.18 | wordfence |
| WF-46ca2967 | wp-subscribe < 1.2.13 |
MEDIUM | 5.5 | WP Subscribe versions up to 1.2.12 is vulnerable to Cross-Site Scripting. This allows authenticated attackers to inject … | 1.2.13 | wordfence |
| WF-4669b08a | dofollow-case-by-case < 3.6.0 |
MEDIUM | 5.5 | The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inclu… | 3.6.0 | wordfence |
| WF-463441f9 | mobile-contact-bar < 3.0.5 |
MEDIUM | 5.5 | The Mobile Contact Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi… | 3.0.5 | wordfence |
| WF-462372ab | mailjet-for-wordpress < 5.3.1 |
MEDIUM | 5.5 | The Mailjet Email Marketing plugin for WordPress is vulnerable to authenticated stored cross-site scripting in versions … | 5.3.1 | wordfence |
| WF-45e61d76 | rencontre < 3.2 |
MEDIUM | 5.5 | The Rencontre – Dating Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'textmail' and 'text… | 3.2 | wordfence |
| WF-45700ca9 | wp-google-maps-pro < 8.1.12 |
MEDIUM | 5.5 | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plu… | 8.1.12 | wordfence |
| WF-455b0b34 | google-sitemap-generator < 4.1.2 |
MEDIUM | 5.5 | The XML Sitemaps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up… | 4.1.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →