Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1244 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-45adeeba | wordpress < 3.6.1 |
MEDIUM | 5.4 | WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to … | 3.6.1 | wordfence |
| WF-45a49dca | insert-special-characters < 1.0.6 |
MEDIUM | 5.4 | The package loader-utils before 1.4.1, from 2.0.0 and before 2.0.3 is vulnerable to prototype pollution via the function… | 1.0.6 | wordfence |
| WF-45a49dca | maps-block-apple < 1.1.0 |
MEDIUM | 5.4 | The package loader-utils before 1.4.1, from 2.0.0 and before 2.0.3 is vulnerable to prototype pollution via the function… | 1.1.0 | wordfence |
| WF-45a49dca | elasticpress < 4.4.0 |
MEDIUM | 5.4 | The package loader-utils before 1.4.1, from 2.0.0 and before 2.0.3 is vulnerable to prototype pollution via the function… | 4.4.0 | wordfence |
| WF-45851efe | yourchannel < 1.2.5 |
MEDIUM | 5.4 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4… | 1.2.5 | wordfence |
| WF-457c4e56 | wp-recipe-maker < 9.1.1 |
MEDIUM | 5.4 | The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.… | 9.1.1 | wordfence |
| WF-453c656a | wp-db-backup < 2.4 |
MEDIUM | 5.4 | The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output … | 2.4 | wordfence |
| WF-45180c8e | ari-stream-quiz < 1.3.0 |
MEDIUM | 5.4 | The ARI Stream Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1… | 1.3.0 | wordfence |
| WF-44e70eb9 | business-directory-plugin < 5.11.2 |
MEDIUM | 5.4 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from la… | 5.11.2 | wordfence |
| WF-44583cb7 | powerpress < 10.0.2 |
MEDIUM | 5.4 | The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versio… | 10.0.2 | wordfence |
| WF-443bae1e | wp-membership | MEDIUM | 5.4 | Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authent… | — | wordfence |
| WF-443a4afc | timed-content < 2.73 |
MEDIUM | 5.4 | The Timed Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in ver… | 2.73 | wordfence |
| WF-44287d9f | mainwp-updraftplus-extension < 4.0.7 |
MEDIUM | 5.4 | The MainWP UpdraftPlus Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and inclu… | 4.0.7 | wordfence |
| WF-43c9b6f2 | simple-event-planner < 1.5.5 |
MEDIUM | 5.4 | The Simple Event Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘&custom[add_seg][]… | 1.5.5 | wordfence |
| WF-43b43802 | wicked-folders < 2.18.17 |
MEDIUM | 5.4 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.… | 2.18.17 | wordfence |
| WF-4352b2dc | woo-alidropship < 1.0.22 |
MEDIUM | 5.4 | The ALD Dropping and Fulfillment for AliExpress and WooCommerce plugin for WordPress is vulnerable to Cross-Site Request… | 1.0.22 | wordfence |
| WF-43357daa | http-auth < 1.0.0 |
MEDIUM | 5.4 | The HTTP Auth plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.3.2. … | 1.0.0 | wordfence |
| WF-432effd4 | accessibility < 1.0.7 |
MEDIUM | 5.4 | The Accessibility plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… | 1.0.7 | wordfence |
| WF-432df51f | wp-chatbot < 4.8 |
MEDIUM | 5.4 | The WP-Chatbot for Messenger plugin for WordPress is vulnerable to unauthorized access and modification of data due to m… | 4.8 | wordfence |
| WF-431d352b | wordpress < 3.7.34 |
MEDIUM | 5.4 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in … | 3.7.34 | wordfence |
| WF-43100062 | customer-reviews-woocommerce < 5.3.6 |
MEDIUM | 5.4 | The Customer Reviews for WooCommerce plugin contains several AJAX actions that are not protected by capability or nonce … | 5.3.6 | wordfence |
| WF-42e8129f | auto-hyperlink-urls | MEDIUM | 5.4 | The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which c… | — | wordfence |
| WF-422ae683 | homesweet | MEDIUM | 5.4 | The HomeSweet - Real Estate WordPress Theme is vulnerable to Insecure Direct Object Reference via 'property_id=2769&remo… | — | wordfence |
| WF-41d03524 | simple-urls < 121 |
MEDIUM | 5.4 | The Simple URLs plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 120. … | 121 | wordfence |
| WF-41b3a62c | download-manager < 3.2.49 |
MEDIUM | 5.4 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ and 'label' p… | 3.2.49 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →