Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1227 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-9aeb996c | woocommerce-pdf-invoices-packing-slips < 2.16.0 |
MEDIUM | 5.4 | The WooCommerce PDF Invoices & Packing Slips plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via th… | 2.16.0 | wordfence |
| WF-9a4c327c | donate-with-qrcode < 1.4.5 |
MEDIUM | 5.4 | The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result … | 1.4.5 | wordfence |
| WF-9a09ec65 | wp-letsencrypt-ssl < 7.8.5.11 |
MEDIUM | 5.4 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is… | 7.8.5.11 | wordfence |
| WF-99f876e0 | litespeed-cache < 7.9.2 |
MEDIUM | 5.4 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all… | 7.9.2 | wordfence |
| WF-99e8017a | ultimate-elementor < 1.30.0 |
MEDIUM | 5.4 | The Ultimate Addons for Elementor WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross… | 1.30.0 | wordfence |
| WF-9945c85b | simple-301-redirects < 2.0.8 |
MEDIUM | 5.4 | The Simple 301 Redirects plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi… | 2.0.8 | wordfence |
| WF-991327f0 | wp-user-frontend < 4.1.13 |
MEDIUM | 5.4 | The The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP… | 4.1.13 | wordfence |
| WF-99051b12 | quick-adsense-reloaded < 2.0.99 |
MEDIUM | 5.4 | The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions u… | 2.0.99 | wordfence |
| WF-98f87769 | shortcodes-ultimate < 5.10.2 |
MEDIUM | 5.4 | The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via sho… | 5.10.2 | wordfence |
| WF-98361cfd | envira-gallery-lite < 1.8.3.3 |
MEDIUM | 5.4 | Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did … | 1.8.3.3 | wordfence |
| WF-9831d7d4 | dd-post-carousel < 1.4.12 |
MEDIUM | 5.4 | The Custom Post Carousels with Owl plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up … | 1.4.12 | wordfence |
| WF-982be9d7 | booking < 9.2.2 |
MEDIUM | 5.4 | The Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, … | 9.2.2 | wordfence |
| WF-97985b75 | advanced-iframe < 2025.7 |
MEDIUM | 5.4 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in … | 2025.7 | wordfence |
| WF-97628ee2 | cp-polls < 1.0.9 |
MEDIUM | 5.4 | The Polls CP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.… | 1.0.9 | wordfence |
| WF-97396207 | wpfront-notification-bar < 2.1.0 |
MEDIUM | 5.4 | The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, whi… | 2.1.0 | wordfence |
| WF-97215367 | cmb2 < 2.13.5 |
MEDIUM | 5.4 | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field … | 2.13.5 | wordfence |
| WF-96e12fa5 | admin-site-enhancements < 7.5.2 |
MEDIUM | 5.4 | The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File upl… | 7.5.2 | wordfence |
| WF-968d5d31 | bridge-core < 3.3.1 |
MEDIUM | 5.4 | The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing… | 3.3.1 | wordfence |
| WF-966a3a33 | chained-quiz < 1.3.2.5 |
MEDIUM | 5.4 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.… | 1.3.2.5 | wordfence |
| WF-963c2d10 | meeting-scheduler-by-vcita < 4.5.2 |
MEDIUM | 5.4 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modif… | 4.5.2 | wordfence |
| WF-961b9a16 | jeg-elementor-kit < 3.2.20 |
MEDIUM | 5.4 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is v… | 3.2.20 | wordfence |
| WF-95d2a05d | profilegrid-user-profiles-groups-and-communities < 5.9.4.3 |
MEDIUM | 5.4 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Requ… | 5.9.4.3 | wordfence |
| WF-958118ec | rabbit-loader < 2.19.14 |
MEDIUM | 5.4 | The RabbitLoader plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missi… | 2.19.14 | wordfence |
| WF-954ef157 | shortcut-macros | MEDIUM | 5.4 | The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its … | — | wordfence |
| WF-954b8064 | gutenberg < 12.7.2 |
MEDIUM | 5.4 | WordPress Core in various versions < 5.9.2 and Gutenberg versions less than 12.7.2 are vulnerable to prototype pollution… | 12.7.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →