Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1214 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-d93c70d6 | prismatic < 2.8 |
MEDIUM | 5.4 | The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users… | 2.8 | wordfence |
| WF-d92bfa61 | wp-discord-invite < 2.5.1 |
MEDIUM | 5.4 | The WP Discord Invite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 2.5.1. This is … | 2.5.1 | wordfence |
| WF-d8fab229 | countdown-builder < 2.7.8.1 |
MEDIUM | 5.4 | The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access … | 2.7.8.1 | wordfence |
| WF-d8cb9488 | website-chat-button-kommo-integration | MEDIUM | 5.4 | The Website Chat Button: Kommo integration plugin for WordPress is vulnerable to unauthorized access due to a missing ca… | — | wordfence |
| WF-d8c1823c | advanced-custom-fields-pro < 6.3.2 |
MEDIUM | 5.4 | The Advanced Custom Fields Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability che… | 6.3.2 | wordfence |
| WF-d8a12e1d | ecwid-shopping-cart < 6.10.23 |
MEDIUM | 5.4 | The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Insufficient Access Control on Multiple AJAX Act… | 6.10.23 | wordfence |
| WF-d888cd53 | pdf-viewer-block < 1.0.1 |
MEDIUM | 5.4 | The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow u… | 1.0.1 | wordfence |
| WF-d875514c | post-type-switcher < 4.0.1 |
MEDIUM | 5.4 | The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inc… | 4.0.1 | wordfence |
| WF-d80199a2 | finale-woocommerce-sales-countdown-timer-discount < 2.18.1 |
MEDIUM | 5.4 | The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to unauthorized … | 2.18.1 | wordfence |
| WF-d7f2b39f | ongkoskirim-id | MEDIUM | 5.4 | The Ongkoskirim.id plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a func… | — | wordfence |
| WF-d7c639b8 | gutentor < 3.5.6 |
MEDIUM | 5.4 | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cro… | 3.5.6 | wordfence |
| WF-d7911337 | audio-merchant | MEDIUM | 5.4 | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… | — | wordfence |
| WF-d703abc2 | jetpack < 6.5 |
MEDIUM | 5.4 | Jetpack up to 6.4.2 is vulnerable to stored Cross-Site Scripting. This allows attackers with contributor privileges to i… | 6.5 | wordfence |
| WF-d6f20fc3 | freshdesk-support < 1.8 |
MEDIUM | 5.4 | The Freshdesk (official) Plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.7. This… | 1.8 | wordfence |
| WF-d6a51962 | wordpress < 3.7.31 |
MEDIUM | 5.4 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled durin… | 3.7.31 | wordfence |
| WF-d66665b6 | wooswipe < 3.0.3 |
MEDIUM | 5.4 | The WooSwipe WooCommerce Gallery plugin for WordPress is vulnerable to authorization bypass due to a missing capability … | 3.0.3 | wordfence |
| WF-d62d0971 | daily-prayer-time-for-mosques < 2021.08.10 |
MEDIUM | 5.4 | The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputt… | 2021.08.10 | wordfence |
| WF-d60f3da1 | customer-reviews-woocommerce < 5.36.1 |
MEDIUM | 5.4 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data and modification … | 5.36.1 | wordfence |
| WF-d608a4c0 | pdfjs-viewer-shortcode < 2.0.2 |
MEDIUM | 5.4 | The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, wh… | 2.0.2 | wordfence |
| WF-d5d12ecc | arforms | MEDIUM | 5.4 | The ARforms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in… | — | wordfence |
| WF-d5a6e9f4 | filebird < 5.1.5 |
MEDIUM | 5.4 | The Filebird plugin for WordPress is vulnerable to unauthorized SPI key generation due to a missing capability check on … | 5.1.5 | wordfence |
| WF-d57b8c89 | nofollow | MEDIUM | 5.4 | The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, … | — | wordfence |
| WF-d5688bb7 | order-your-posts-manually | MEDIUM | 5.4 | The Order Your Posts Manually plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'cat_id' para… | — | wordfence |
| WF-d55c832b | form-maker < 1.15.22 |
MEDIUM | 5.4 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross… | 1.15.22 | wordfence |
| WF-d4cc9537 | publishpress-authors < 4.16.0 |
MEDIUM | 5.4 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vu… | 4.16.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →