Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1206 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-043263a1 | slider-wd < 1.2.56 |
MEDIUM | 5.5 | The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all… | 1.2.56 | wordfence |
| WF-03cd1f6e | yikes-inc-easy-custom-woocommerce-product-tabs < 1.8.0 |
MEDIUM | 5.5 | The Custom Product Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi… | 1.8.0 | wordfence |
| WF-03a1724c | export-users-data-distinct | MEDIUM | 5.5 | The Export Users Data Distinct plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3… | — | wordfence |
| WF-03725477 | jetpack-boost < 3.4.7 |
MEDIUM | 5.5 | The Jetpack Boost – Website Speed, Performance and Critical CSS plugin for WordPress is vulnerable to Server-Side Requ… | 3.4.7 | wordfence |
| WF-0306c785 | wp-admin-ui-customize < 1.5.13 |
MEDIUM | 5.5 | The WP Admin UI Customize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘footer text’ pa… | 1.5.13 | wordfence |
| WF-028a90c7 | conversational-forms < 1.1.7 |
MEDIUM | 5.5 | The Conversational Forms for ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via a form name in versi… | 1.1.7 | wordfence |
| WF-0252d07a | wp-reset < 1.90 |
MEDIUM | 5.5 | The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_da… | 1.90 | wordfence |
| WF-02319fc2 | newsletter < 8.8.5 |
MEDIUM | 5.5 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting … | 8.8.5 | wordfence |
| WF-012e7aed | skimlinks | MEDIUM | 5.5 | The Skimlinks Affiliate Marketing Tool plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions… | — | wordfence |
| WF-0016c624 | wp-socializer < 7.3 |
MEDIUM | 5.5 | The WP Socializer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘misc_additional_css’ pa… | 7.3 | wordfence |
| WF-0004db27 | opening-hours < 1.38 |
MEDIUM | 5.5 | The We’re Open! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its setting parameter… | 1.38 | wordfence |
| WF-ff937860 | easy-table-of-contents < 2.0.46 |
MEDIUM | 5.4 | The Easy Table of Contents plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due … | 2.0.46 | wordfence |
| WF-ff7e7539 | auto-youtube-importer < 1.0.4 |
MEDIUM | 5.4 | The Auto YouTube Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ… | 1.0.4 | wordfence |
| WF-fec9a7a6 | admin-site-enhancements < 7.9.8 |
MEDIUM | 5.4 | The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File upl… | 7.9.8 | wordfence |
| WF-fe67064b | ht-mega-for-elementor < 3.2.8 |
MEDIUM | 5.4 | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored D… | 3.2.8 | wordfence |
| WF-fe25ac93 | powerpress < 11.12.7 |
MEDIUM | 5.4 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Server-Side Request Forgery in all ver… | 11.12.7 | wordfence |
| WF-fe14b92b | minify-html-markup < 2.1.13 |
MEDIUM | 5.4 | The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2… | 2.1.13 | wordfence |
| WF-fdc57b06 | fusion-builder < 3.15.2 |
MEDIUM | 5.4 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up… | 3.15.2 | wordfence |
| WF-fd9f1385 | awesome-support < 6.1.11 |
MEDIUM | 5.4 | The Awesome Support plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an un… | 6.1.11 | wordfence |
| WF-fd5f370c | scheduler-widget | MEDIUM | 5.4 | The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i… | — | wordfence |
| WF-fd53b4e1 | addon-elements-for-elementor-page-builder < 1.12.8 |
MEDIUM | 5.4 | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inc… | 1.12.8 | wordfence |
| WF-fd3bf470 | fluentformpro < 6.1.13 |
MEDIUM | 5.4 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to… | 6.1.13 | wordfence |
| WF-fd23b9cd | wordpress < 3.7.26 |
MEDIUM | 5.4 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. | 3.7.26 | wordfence |
| WF-fd12ce4a | restropress < 2.8.3.1 |
MEDIUM | 5.4 | The RestroPress plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 2.8.3. Thi… | 2.8.3.1 | wordfence |
| WF-fcfb3a6e | custom-registration-form-builder-with-submission-manager < 5.1.9.3 |
MEDIUM | 5.4 | The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,… | 5.1.9.3 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →