Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1207 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-fcd756ea | accelerated-mobile-pages < 1.1.19 |
MEDIUM | 5.4 | The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in a… | 1.1.19 | wordfence |
| WF-fcb1f4db | facilita-form-tracker | MEDIUM | 5.4 | The Facilita Form Tracker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in… | — | wordfence |
| WF-fc7bab78 | comment-blacklist-updater < 1.2.0 |
MEDIUM | 5.4 | The Comment Blacklist Updater plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and in… | 1.2.0 | wordfence |
| WF-fc58c679 | motors-car-dealership-classified-listings < 1.4.44 |
MEDIUM | 5.4 | The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution… | 1.4.44 | wordfence |
| WF-fc215aad | qi-blocks < 1.4 |
MEDIUM | 5.4 | The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.… | 1.4 | wordfence |
| WF-fafdd087 | essential-addons-for-elementor-lite < 5.9.9 |
MEDIUM | 5.4 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPre… | 5.9.9 | wordfence |
| WF-fa52034e | broken-link-finder < 2.5.1 |
MEDIUM | 5.4 | The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions… | 2.5.1 | wordfence |
| WF-f9844b47 | wcp-contact-form | MEDIUM | 5.4 | The WCP Contact Form plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing… | — | wordfence |
| WF-f932e3ea | mainwp-staging-extension < 4.0.4 |
MEDIUM | 5.4 | The MainWP Staging Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and including… | 4.0.4 | wordfence |
| WF-f9150e6b | mainwp-seo-extension < 4.0.3 |
MEDIUM | 5.4 | The MainWP WordPress SEO Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and inc… | 4.0.3 | wordfence |
| WF-f9036277 | greenshift-animation-and-page-builder-blocks < 13.2.3 |
MEDIUM | 5.4 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site S… | 13.2.3 | wordfence |
| WF-f884ea43 | gravityforms < 2.9.2 |
MEDIUM | 5.4 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ paramet… | 2.9.2 | wordfence |
| WF-f882da12 | page-views-count < 2.4.9 |
MEDIUM | 5.4 | The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing … | 2.4.9 | wordfence |
| WF-f8575c46 | advanced-wp-reset < 1.6 |
MEDIUM | 5.4 | The Advanced WordPress Reset plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘DBR_new_URI… | 1.6 | wordfence |
| WF-f80a1fa2 | events-made-easy < 3.2.23 |
MEDIUM | 5.4 | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' pa… | 3.2.23 | wordfence |
| WF-f7ae863c | yourchannel < 1.2.5 |
MEDIUM | 5.4 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4… | 1.2.5 | wordfence |
| WF-f71453d9 | smart-app-banner < 1.1.3 |
MEDIUM | 5.4 | The Smart App Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, … | 1.1.3 | wordfence |
| WF-f70221e6 | sheets-to-wp-table-live-sync < 2.13.0 |
MEDIUM | 5.4 | The Sheets To WP Table Live Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and… | 2.13.0 | wordfence |
| WF-f6e2ab69 | simple-ajax-chat < 20220216 |
MEDIUM | 5.4 | The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,… | 20220216 | wordfence |
| WF-f6a41a90 | svg-support < 2.5.9 |
MEDIUM | 5.4 | The SVG Support plugin for WordPress is running a vulnerable dependency (svg-sanitize, 0.14.1) in all versions up to, an… | 2.5.9 | wordfence |
| WF-f67ab0cf | easy-notify-lite < 1.1.39 |
MEDIUM | 5.4 | The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a mi… | 1.1.39 | wordfence |
| WF-f62063c8 | tenweb-speed-optimizer < 2.8.35 |
MEDIUM | 5.4 | The 10Web Booster plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the tw… | 2.8.35 | wordfence |
| WF-f618a350 | contact-form-with-captcha | MEDIUM | 5.4 | The Contact Form With Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and in… | — | wordfence |
| WF-f61873db | user-registration < 5.3.0 |
MEDIUM | 5.4 | The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Cu… | 5.3.0 | wordfence |
| WF-f603a25f | delete-duplicate-posts < 4.9 |
MEDIUM | 5.4 | The Delete Duplicate Posts plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capabili… | 4.9 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →