Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1235 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-72dc919a | woocommerce-support-ticket-system < 17.9 |
MEDIUM | 5.4 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to … | 17.9 | wordfence |
| WF-72bcfd2a | svg-support < 2.5.8 |
MEDIUM | 5.4 | The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all vers… | 2.5.8 | wordfence |
| WF-72934d2f | social-auto-poster < 5.3.15 |
MEDIUM | 5.4 | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability c… | 5.3.15 | wordfence |
| WF-7238a6ba | wp-recipe-maker < 10.8.2 |
MEDIUM | 5.4 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all v… | 10.8.2 | wordfence |
| WF-71f58781 | wp-google-map-plugin < 4.4.3 |
MEDIUM | 5.4 | The WP Google Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi… | 4.4.3 | wordfence |
| WF-71d916aa | themify-portfolio-post < 1.1.6 |
MEDIUM | 5.4 | Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lea… | 1.1.6 | wordfence |
| WF-71b3bec2 | updraftplus < 1.13.5 |
MEDIUM | 5.4 | The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a… | 1.13.5 | wordfence |
| WF-711d2c4d | cbcurrencyconverter < 3.0.4 |
MEDIUM | 5.4 | The CBX Currency Converter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu… | 3.0.4 | wordfence |
| WF-71114965 | w3-total-cache < 0.9.4.1 |
MEDIUM | 5.4 | Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is e… | 0.9.4.1 | wordfence |
| WF-70cd028d | permalink-manager < 2.4.3.2 |
MEDIUM | 5.4 | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa… | 2.4.3.2 | wordfence |
| WF-70434876 | same-category-posts < 1.1.20 |
MEDIUM | 5.4 | The Same Category Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title placehold… | 1.1.20 | wordfence |
| WF-7036400d | csv-import-export | MEDIUM | 5.4 | Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow … | — | wordfence |
| WF-702f9d3b | wp-meta-seo < 4.5.4 |
MEDIUM | 5.4 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on t… | 4.5.4 | wordfence |
| WF-6fd4fa08 | code-snippets-extended | MEDIUM | 5.4 | Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPr… | — | wordfence |
| WF-6fb9c8c3 | legal-pages < 1.3.9 |
MEDIUM | 5.4 | The Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.8… | 1.3.9 | wordfence |
| WF-6f6ece0e | recipe-card-blocks-by-wpzoom < 2.8.3 |
MEDIUM | 5.4 | The Recipe Card Blocks by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, an… | 2.8.3 | wordfence |
| WF-6f1f479c | mycred < 4.0.3 |
MEDIUM | 5.4 | The The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for Word… | 4.0.3 | wordfence |
| WF-6f1e0b89 | hello-plus < 1.7.8 |
MEDIUM | 5.4 | The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. T… | 1.7.8 | wordfence |
| WF-6f17d54b | hercules-core < 6.7 |
MEDIUM | 5.4 | The Hercules Core plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… | 6.7 | wordfence |
| WF-6f14f19d | maintenance-switch | MEDIUM | 5.4 | The Maintenance Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including… | — | wordfence |
| WF-6f01ecab | molongui-authorship < 4.7.4 |
MEDIUM | 5.4 | The Molongui plugin for WordPress is vulnerable to unauthorized modification and access of data due to missing capabilit… | 4.7.4 | wordfence |
| WF-6ec069ef | arca-payment-gateway < 1.3.4 |
MEDIUM | 5.4 | The ArCa Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… | 1.3.4 | wordfence |
| WF-6e98fb74 | th-variation-swatches < 1.2.8 |
MEDIUM | 5.4 | The TH Variation Swatches plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ… | 1.2.8 | wordfence |
| WF-6e736e75 | easy-svg < 3.3.0 |
MEDIUM | 5.4 | The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a … | 3.3.0 | wordfence |
| WF-6e2128db | greenshift-animation-and-page-builder-blocks < 12.6.1 |
MEDIUM | 5.4 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data d… | 12.6.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →