Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1467 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-73c3dfc7 | wp-appbox < 4.3.21 |
MEDIUM | 4.8 | Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20. | 4.3.21 | wordfence |
| WF-736cb9a4 | add-search-to-menu < 5.4.1 |
MEDIUM | 4.8 | The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privile… | 5.4.1 | wordfence |
| WF-728cec6e | fathom-analytics < 3.0.5 |
MEDIUM | 4.8 | The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation … | 3.0.5 | wordfence |
| WF-6f7e0aa7 | advanced-access-manager < 6.8.0 |
MEDIUM | 4.8 | The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, all… | 6.8.0 | wordfence |
| WF-6d7f9291 | woocommerce-pdf-invoices-packing-slips < 2.10.5 |
MEDIUM | 4.8 | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section paramete… | 2.10.5 | wordfence |
| WF-6d564606 | photo-gallery < 1.5.67 |
MEDIUM | 4.8 | The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the … | 1.5.67 | wordfence |
| WF-6c31f7d3 | wp-event-manager < 3.1.23 |
MEDIUM | 4.8 | The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting th… | 3.1.23 | wordfence |
| WF-6bfc0128 | miniorange-google-authenticator < 1.0.8 |
MEDIUM | 4.8 | The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its … | 1.0.8 | wordfence |
| WF-6b8ed659 | quiz-master-next < 7.3.2 |
MEDIUM | 4.8 | The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it … | 7.3.2 | wordfence |
| WF-67e9bfb8 | wp-compress-image-optimizer < 7.26.00 |
MEDIUM | 4.8 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation … | 7.26.00 | wordfence |
| WF-674f75d7 | nextgen-gallery < 2.2.45 |
MEDIUM | 4.8 | Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Ti… | 2.2.45 | wordfence |
| WF-64b49f24 | recent-posts-widget-extended < 0.9.9.4 |
MEDIUM | 4.8 | The Recent Posts Widget Extended plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and inclu… | 0.9.9.4 | wordfence |
| WF-64338fc4 | ninja-tables < 4.1.8 |
MEDIUM | 4.8 | The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow … | 4.1.8 | wordfence |
| WF-63089b8f | wc-product-table-lite < 3.8.6 |
MEDIUM | 4.8 | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versio… | 3.8.6 | wordfence |
| WF-606b9002 | cybersoldier < 1.7.0 |
MEDIUM | 4.8 | The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an … | 1.7.0 | wordfence |
| WF-5d432ea5 | mystickymenu < 2.5.2 |
MEDIUM | 4.8 | The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin … | 2.5.2 | wordfence |
| WF-5c6f4890 | w-dalil | MEDIUM | 4.8 | The W-DALIL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$dalil_information’ parameter… | — | wordfence |
| WF-5b3081ff | wp-ultimate-csv-importer < 6.4.3 |
MEDIUM | 4.8 | The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped… | 6.4.3 | wordfence |
| WF-5a563439 | smooth-page-scroll-updown-buttons < 1.4 |
MEDIUM | 4.8 | The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_posi… | 1.4 | wordfence |
| WF-59cdb3e3 | sprout-invoices < 19.9.7 |
MEDIUM | 4.8 | The Client Invoicing by Sprout Invoices plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up… | 19.9.7 | wordfence |
| WF-58bdd837 | wpfront-notification-bar < 2.0.0 |
MEDIUM | 4.8 | The WPFront Notification Bar WordPress plugin before 2.0.0 does not sanitise or escape its Custom CSS setting, allowing … | 2.0.0 | wordfence |
| WF-586137a5 | google-maps-easy < 1.10.1 |
MEDIUM | 4.8 | The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation … | 1.10.1 | wordfence |
| WF-56a362f3 | easy-digital-downloads < 2.11.2.1 |
MEDIUM | 4.8 | The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end… | 2.11.2.1 | wordfence |
| WF-535c4796 | ays-popup-box < 6.4.3 |
MEDIUM | 4.8 | The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is du… | 6.4.3 | wordfence |
| WF-52af7568 | dark-mode < 1.7 |
MEDIUM | 4.8 | An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_sta… | 1.7 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →