Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1464 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-e6838714 | caldera-forms < 1.9.5 |
MEDIUM | 4.8 | The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attri… | 1.9.5 | wordfence |
| WF-e6650eb7 | product-reviews-import-export-for-woocommerce < 1.4.9 |
MEDIUM | 4.8 | The Product Reviews Import Export for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to,… | 1.4.9 | wordfence |
| WF-e608c75f | bannerman | MEDIUM | 4.8 | The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged… | — | wordfence |
| WF-e5748252 | e2pdf < 1.16.45 |
MEDIUM | 4.8 | The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high priv… | 1.16.45 | wordfence |
| WF-e52f799e | awesome-support < 6.0.14 |
MEDIUM | 4.8 | The awesome-support plugin 6.0.13 and below for WordPress allows XSS via the post_title parameter. | 6.0.14 | wordfence |
| WF-e404d689 | maxgalleria < 6.2.7 |
MEDIUM | 4.8 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria Wor… | 6.2.7 | wordfence |
| WF-e3702936 | protect-uploads < 0.4 |
MEDIUM | 4.8 | The Protect uploads plugin for WordPress failed to use a capability check and leaked the nonce necessary to save changes… | 0.4 | wordfence |
| WF-e0df0a4e | callbook-mobile-bar | MEDIUM | 4.8 | The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could a… | — | wordfence |
| WF-df2674c9 | mailarchiver < 4.5.0 |
MEDIUM | 4.8 | The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… | 4.5.0 | wordfence |
| WF-dde57a98 | formidable < 5.0.07 |
MEDIUM | 4.8 | The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not san… | 5.0.07 | wordfence |
| WF-dab3786b | titan-labs-security-audit | MEDIUM | 4.8 | The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow hi… | — | wordfence |
| WF-d6286cda | nextcellent-gallery-nextgen-legacy | MEDIUM | 4.8 | The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which c… | — | wordfence |
| WF-d3ace116 | weather-effect < 1.3.6 |
MEDIUM | 4.8 | The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size… | 1.3.6 | wordfence |
| WF-cfc59270 | petfinder-listings < 1.0.19 |
MEDIUM | 4.8 | The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such … | 1.0.19 | wordfence |
| WF-cf44a96e | wp-video-lightbox < 1.9.6 |
MEDIUM | 4.8 | The Video Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions … | 1.9.6 | wordfence |
| WF-cede7e6f | export-woocommerce-customer-list < 2.0.69 |
MEDIUM | 4.8 | The Export customers list csv plugin for WooCommerce is vulnerable to CSV Injection in versions up to, and including, 2.… | 2.0.69 | wordfence |
| WF-cde35356 | remove-footer-credit < 1.0.11 |
MEDIUM | 4.8 | The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege use… | 1.0.11 | wordfence |
| WF-cdb3cdf8 | gmap-embed < 1.7.7 |
MEDIUM | 4.8 | The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the p… | 1.7.7 | wordfence |
| WF-cbd4f08c | wp-all-import < 3.6.3 |
MEDIUM | 4.8 | The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier… | 3.6.3 | wordfence |
| WF-cb714378 | erident-custom-login-and-dashboard < 3.5.9 |
MEDIUM | 4.8 | The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing hi… | 3.5.9 | wordfence |
| WF-c95210ba | autoptimize < 2.7.8 |
MEDIUM | 4.8 | The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded v… | 2.7.8 | wordfence |
| WF-c6e7ada1 | per-page-add-to | MEDIUM | 4.8 | The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing maliciou… | — | wordfence |
| WF-c32824cc | wpglobus < 1.9.7 |
MEDIUM | 4.8 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.p… | 1.9.7 | wordfence |
| WF-c1a0d446 | cluevo-lms < 1.8.1 |
MEDIUM | 4.8 | The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which co… | 1.8.1 | wordfence |
| WF-c0dfa035 | maintenance < 4.03 |
MEDIUM | 4.8 | The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege u… | 4.03 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →