Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1232 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-801d6f21 | wordpress < 3.7.21 |
MEDIUM | 5.4 | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. | 3.7.21 | wordfence |
| WF-7fdb93fa | mainwp-page-speed-extension < 4.0.3 |
MEDIUM | 5.4 | The MainWP Page Speed Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and includ… | 4.0.3 | wordfence |
| WF-7fbbd0d7 | wisdm-reports-for-learndash < 1.8.2.2 |
MEDIUM | 5.4 | The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… | 1.8.2.2 | wordfence |
| WF-7fa5ac48 | ultimate-addons-for-beaver-builder-lite < 1.5.5 |
MEDIUM | 5.4 | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in vers… | 1.5.5 | wordfence |
| WF-7f787c75 | wp-auto-affiliate-links < 6.2.1.6 |
MEDIUM | 5.4 | The Auto Affiliate Links plugin for WordPress is vulnerable to improper access control via multiple AJAX actions in vers… | 6.2.1.6 | wordfence |
| WF-7f4c0bd6 | responsive-lightbox < 2.5.4 |
MEDIUM | 5.4 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up t… | 2.5.4 | wordfence |
| WF-7f17e055 | atarim-visual-collaboration < 4.0.3 |
MEDIUM | 5.4 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unautho… | 4.0.3 | wordfence |
| WF-7f01ad95 | editorial-calendar < 3.8.0 |
MEDIUM | 5.4 | The Editorial Calendar plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and inc… | 3.8.0 | wordfence |
| WF-7ee188cc | uncode < 2.9.1.7 |
MEDIUM | 5.4 | The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in a… | 2.9.1.7 | wordfence |
| WF-7edad4f6 | yop-poll < 6.3.1 |
MEDIUM | 5.4 | The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in th… | 6.3.1 | wordfence |
| WF-7dfd0246 | woo-bulk-editor < 1.1.4 |
MEDIUM | 5.4 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to … | 1.1.4 | wordfence |
| WF-7dcd3452 | regina-lite | MEDIUM | 5.4 | The Regina Lite theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in versio… | — | wordfence |
| WF-7dc6d1db | appointment-booking-calendar < 1.3.83 |
MEDIUM | 5.4 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,… | 1.3.83 | wordfence |
| WF-7d500729 | redirect-redirection < 1.1.5 |
MEDIUM | 5.4 | The Redirect Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi… | 1.1.5 | wordfence |
| WF-7d4ae4a7 | email-subscribers < 5.7.35 |
MEDIUM | 5.4 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin… | 5.7.35 | wordfence |
| WF-7d30e813 | easy-affiliate-links < 3.7.1 |
MEDIUM | 5.4 | The Easy Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block settin… | 3.7.1 | wordfence |
| WF-7d19800a | custom-order-numbers-for-woocommerce < 1.4.1 |
MEDIUM | 5.4 | The Custom Order Numbers for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up… | 1.4.1 | wordfence |
| WF-7cc96e83 | google-maps < 2.1.4 |
MEDIUM | 5.4 | The Google Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' URL parameter in versi… | 2.1.4 | wordfence |
| WF-7cbc157b | scratch-win-giveaways-for-website-facebook < 2.8.0 |
MEDIUM | 5.4 | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plug… | 2.8.0 | wordfence |
| WF-7c9b9ab3 | image-hover-effects-addon-for-elementor | MEDIUM | 5.4 | The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to unauthorized access due to a missing c… | — | wordfence |
| WF-7c89eb8e | oshine-core | MEDIUM | 5.4 | The Oshine Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a functio… | — | wordfence |
| WF-7c6fe986 | addon-elements-for-elementor-page-builder < 1.11.2 |
MEDIUM | 5.4 | The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cros… | 1.11.2 | wordfence |
| WF-7c6b7dca | gamipress < 2.5.1 |
MEDIUM | 5.4 | The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.0. … | 2.5.1 | wordfence |
| WF-7c632452 | image-map-pro < 6.0.21 |
MEDIUM | 5.4 | The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a miss… | 6.0.21 | wordfence |
| WF-7bf1d6f9 | ultimate-store-kit < 3.0.8 |
MEDIUM | 5.4 | The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in va… | 3.0.8 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →