Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1463 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-0101113b | fluentform < 6.2.2 |
MEDIUM | 4.9 | The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This i… | 6.2.2 | wordfence |
| WF-000229b1 | wpvivid-backuprestore < 0.9.138 |
MEDIUM | 4.9 | The WPvivid — Backup, Migration & Staging plugin for WordPress is vulnerable to Path Traversal in all versions up to 0… | 0.9.138 | wordfence |
| WF-fe708e03 | pricing-table | MEDIUM | 4.8 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress p… | — | wordfence |
| WF-fd67e334 | wp-customer-reviews < 3.5.6 |
MEDIUM | 4.8 | The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege use… | 3.5.6 | wordfence |
| WF-fb6719d8 | bft-autoresponder < 2.5.1.9 |
MEDIUM | 4.8 | These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:4… | 2.5.1.9 | wordfence |
| WF-fa63a325 | floating-div | MEDIUM | 4.8 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating … | — | wordfence |
| WF-f9ae88f8 | modern-events-calendar-lite < 5.22.2 |
MEDIUM | 4.8 | The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting th… | 5.22.2 | wordfence |
| WF-f85f2fbb | ag-custom-admin < 7.0 |
MEDIUM | 4.8 | The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high priv… | 7.0 | wordfence |
| WF-f4198c51 | wp-social-buttons < 2.2 |
MEDIUM | 4.8 | The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege us… | 2.2 | wordfence |
| WF-f371feb6 | sign-up-sheets < 1.0.14 |
MEDIUM | 4.8 | The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new shee… | 1.0.14 | wordfence |
| WF-f3543ce7 | seur < 1.7.0 |
MEDIUM | 4.8 | The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege… | 1.7.0 | wordfence |
| WF-f2fee7aa | bookingcom-banner-creator < 1.4.3 |
MEDIUM | 4.8 | The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, wh… | 1.4.3 | wordfence |
| WF-f2f4313a | simple-social-buttons < 3.2.4 |
MEDIUM | 4.8 | The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outp… | 3.2.4 | wordfence |
| WF-f20aff55 | bbpress < 2.6.5 |
MEDIUM | 4.8 | The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript exe… | 2.6.5 | wordfence |
| WF-f15d39ba | wp-downloadmanager < 1.68.7 |
MEDIUM | 4.8 | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plug… | 1.68.7 | wordfence |
| WF-f09584f9 | easy-pricing-tables < 3.1.3 |
MEDIUM | 4.8 | Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables… | 3.1.3 | wordfence |
| WF-f01e9908 | miniorange-malware-protection < 4.5.2 |
MEDIUM | 4.8 | The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to maliciou… | 4.5.2 | wordfence |
| WF-efd18739 | mylinksdump | MEDIUM | 4.8 | The myLinksDump plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_title' parameter in all … | — | wordfence |
| WF-eeae71a6 | cookie-notice < 2.1.2 |
MEDIUM | 4.8 | The WP GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Text setting in versions up… | 2.1.2 | wordfence |
| WF-ee4a9dc6 | hpbtool | MEDIUM | 4.8 | The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow hi… | — | wordfence |
| WF-edcc51f8 | official-statcounter-plugin-for-wordpress < 2.0.7 |
MEDIUM | 4.8 | The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, whic… | 2.0.7 | wordfence |
| WF-ed7f3f80 | acf-extended < 0.9.2.7 |
MEDIUM | 4.8 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, a… | 0.9.2.7 | wordfence |
| WF-eaf0d324 | ninja-forms < 3.6.10 |
MEDIUM | 4.8 | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via field labels in versi… | 3.6.10 | wordfence |
| WF-e97ed28c | stock-ticker < 3.26.2 |
MEDIUM | 4.8 | The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… | 3.26.2 | wordfence |
| WF-e6a9ae9e | foogallery < 1.8.18 |
MEDIUM | 4.8 | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. Please note this requires administrat… | 1.8.18 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →