Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1197 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-4554235f | video-synchro-pdf | MEDIUM | 5.5 | The Videos sync PDF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in versi… | — | wordfence |
| WF-44a8b7fb | responsive-tabs < 2.2.7 |
MEDIUM | 5.5 | The Responsive Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Slides Per View paramet… | 2.2.7 | wordfence |
| WF-445e762c | interactive-medical-drawing-of-human-body | MEDIUM | 5.5 | The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… | — | wordfence |
| WF-4419a302 | ultimate-addons-for-gutenberg < 1.14.8 |
MEDIUM | 5.5 | The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to,… | 1.14.8 | wordfence |
| WF-43df6d4d | duplicate-page < 4.4.2 |
MEDIUM | 5.5 | The Duplicate Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Duplicate Post Suffix setti… | 4.4.2 | wordfence |
| WF-43c9dcec | wp-user-avatar < 4.5.1 |
MEDIUM | 5.5 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions u… | 4.5.1 | wordfence |
| WF-438bbd0f | campus-directory < 1.7.5 |
MEDIUM | 5.5 | The Faculty Staff and Student Directory Plugin – Campus Directory plugin for WordPress is vulnerable to authenticated … | 1.7.5 | wordfence |
| WF-436cd742 | highlight < 0.9.3 |
MEDIUM | 5.5 | The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to pe… | 0.9.3 | wordfence |
| WF-4364e713 | profile-builder < 2.5.8 |
MEDIUM | 5.5 | The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wppb_general_settings[m… | 2.5.8 | wordfence |
| WF-4261c81e | frndzk-expandable-bottom-bar | MEDIUM | 5.5 | The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter … | — | wordfence |
| WF-42308a6e | randomquotr | MEDIUM | 5.5 | The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up … | — | wordfence |
| WF-42156e9f | better-delete-revision | MEDIUM | 5.5 | The Better Delete Revision plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$bdr_rev_no’ p… | — | wordfence |
| WF-41d73ce6 | jobboardwp < 1.2.0 |
MEDIUM | 5.5 | The JobBoardWP – Job Board Listings and Submissions WordPress plugin may be vulnerable to Stored Cross-Site Scripting … | 1.2.0 | wordfence |
| WF-41428fa7 | slider-hero < 8.7.0 |
MEDIUM | 5.5 | The Slider Hero with Animation, Video Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a… | 8.7.0 | wordfence |
| WF-4101bd5e | add-comments | MEDIUM | 5.5 | The Add Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various plugin settings parameter… | — | wordfence |
| WF-40f909ca | wp-auctions | MEDIUM | 5.5 | The WordPress Auction Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and in… | — | wordfence |
| WF-404fab1b | ninja-tables < 5.0.10 |
MEDIUM | 5.5 | The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all… | 5.0.10 | wordfence |
| WF-3feb84c9 | codelights-shortcodes-and-widgets | MEDIUM | 5.5 | The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS… | — | wordfence |
| WF-3fad525f | opening-hours < 1.42 |
MEDIUM | 5.5 | The We’re Open! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions u… | 1.42 | wordfence |
| WF-3f6d9c23 | wp-custom-taxonomy-meta | MEDIUM | 5.5 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image me… | — | wordfence |
| WF-3f5eef96 | salat-times < 3.2.2 |
MEDIUM | 5.5 | The Salat Times plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Widget Title parameter in vers… | 3.2.2 | wordfence |
| WF-3f3aec3a | slider-wd < 1.2.53 |
MEDIUM | 5.5 | The Sliderby10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via slider row links in versions up … | 1.2.53 | wordfence |
| WF-3e7105d3 | blocksy < 2.1.7 |
MEDIUM | 5.5 | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.6 due… | 2.1.7 | wordfence |
| WF-3d8b8f54 | text-hover < 4.2 |
MEDIUM | 5.5 | The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privil… | 4.2 | wordfence |
| WF-3d54f585 | wp-user-avatar < 4.5.1 |
MEDIUM | 5.5 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_imag… | 4.5.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →