Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1212 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-e2cc2776 | beaver-builder-lite-version < 2.7.4.3 |
MEDIUM | 5.4 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scrip… | 2.7.4.3 | wordfence |
| WF-e27bd526 | wp-log-viewer | MEDIUM | 5.4 | The WP Log Viewer plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability ch… | — | wordfence |
| WF-e2152db7 | email-subscribers < 4.2.3 |
MEDIUM | 5.4 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on … | 4.2.3 | wordfence |
| WF-e1be11c5 | updraftplus < 1.23.11 |
MEDIUM | 5.4 | The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in… | 1.23.11 | wordfence |
| WF-e1b80852 | windows-azure-storage < 4.5.2 |
MEDIUM | 5.4 | The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in… | 4.5.2 | wordfence |
| WF-e1b473fd | the-total-book-project < 1.1 |
MEDIUM | 5.4 | The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,… | 1.1 | wordfence |
| WF-e17dd3e7 | one-user-avatar < 2.3.7 |
MEDIUM | 5.4 | The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allow… | 2.3.7 | wordfence |
| WF-e16b8686 | tlp-team < 5.0.7 |
MEDIUM | 5.4 | The Team plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in ve… | 5.0.7 | wordfence |
| WF-e166a7db | bold-page-builder < 4.8.1 |
MEDIUM | 5.4 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in a… | 4.8.1 | wordfence |
| WF-e122d75b | apollo13-framework-extensions < 1.9.0 |
MEDIUM | 5.4 | The Apollo13 Framework Extensions plugin for WordPress is vulnerable to missing authorization due to a missing capabilit… | 1.9.0 | wordfence |
| WF-e087817e | wp-all-backup | MEDIUM | 5.4 | The WP All Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4… | — | wordfence |
| WF-e033dd4a | export-post-info < 1.2.1 |
MEDIUM | 5.4 | The Export Post Info plugin for WordPress is vulnerable to CSV Injection. This allows authenticated users with author pe… | 1.2.1 | wordfence |
| WF-dfa2af3d | bxslider-wp | MEDIUM | 5.4 | The BxSlider WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions u… | — | wordfence |
| WF-df9b0578 | themify-portfolio-post < 1.1.7 |
MEDIUM | 5.4 | Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outp… | 1.1.7 | wordfence |
| WF-df6e5aee | premium-addons-pro < 2.9.1 |
MEDIUM | 5.4 | The Premium Addons PRO plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capabili… | 2.9.1 | wordfence |
| WF-df09d88a | ameliabooking < 2.4.5 |
MEDIUM | 5.4 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access an… | 2.4.5 | wordfence |
| WF-debe6f54 | newsmag | MEDIUM | 5.4 | The Newsmag theme for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to,… | — | wordfence |
| WF-dea1e775 | gsheetconnector-gravity-forms < 1.3.5 |
MEDIUM | 5.4 | The Gravity Forms Google Sheet Connector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up… | 1.3.5 | wordfence |
| WF-de9a945b | show-hidecollapse-expand < 1.3.0 |
MEDIUM | 5.4 | The Show-Hide / Collapse-Expand plugin for WordPress is vulnerable to authorization bypass due to a missing capability c… | 1.3.0 | wordfence |
| WF-de91c6f1 | woocommerce-customers-manager < 30.1 |
MEDIUM | 5.4 | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… | 30.1 | wordfence |
| WF-de614bbd | essential-addons-for-elementor-lite < 4.5.4 |
MEDIUM | 5.4 | The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cros… | 4.5.4 | wordfence |
| WF-de5397c2 | dnui-delete-not-used-image-wordpress | MEDIUM | 5.4 | The DNUI plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This … | — | wordfence |
| WF-de4ba999 | rccp-free | MEDIUM | 5.4 | The RingCentral Communications Plugin – FREE plugin for WordPress is vulnerable to Cross-Site Request Forgery in all v… | — | wordfence |
| WF-de3a6e77 | activity-reactions-for-buddypress | MEDIUM | 5.4 | The Activity Reactions For Buddypress plugin for WordPress is vulnerable to missing authorization checks in versions up … | — | wordfence |
| WF-de1742d4 | elementor-pro < 3.20.2 |
MEDIUM | 5.4 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pos… | 3.20.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →