Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1468 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-50e373bd | visual-form-builder < 3.0.4 |
MEDIUM | 4.8 | The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege… | 3.0.4 | wordfence |
| WF-4dcc6225 | wp-nested-pages < 3.1.21 |
MEDIUM | 4.8 | The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow… | 3.1.21 | wordfence |
| WF-4dbaeabb | woocommerce < 5.2.0 |
MEDIUM | 4.8 | The WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Additional tax classes' field… | 5.2.0 | wordfence |
| WF-4d2d435f | graphic-web-design-inc | MEDIUM | 4.8 | The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up… | — | wordfence |
| WF-4bca364b | mimetic-books | MEDIUM | 4.8 | The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in t… | — | wordfence |
| WF-4b3786d2 | wp-paginate < 2.1.4 |
MEDIUM | 4.8 | The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege … | 2.1.4 | wordfence |
| WF-4a515dc9 | quiz-tool-lite | MEDIUM | 4.8 | The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managin… | — | wordfence |
| WF-49fc7174 | wp-courses < 2.0.44 |
MEDIUM | 4.8 | The WP Courses LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions before 2.0.44 due to i… | 2.0.44 | wordfence |
| WF-49ac9c7c | addthis < 5.0.13 |
MEDIUM | 4.8 | The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=add… | 5.0.13 | wordfence |
| WF-498087da | give < 2.12.0 |
MEDIUM | 4.8 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level… | 2.12.0 | wordfence |
| WF-4489d26b | learnpress < 4.1.3.1 |
MEDIUM | 4.8 | The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course setting… | 4.1.3.1 | wordfence |
| WF-43f6a5c2 | sociable | MEDIUM | 4.8 | The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in… | — | wordfence |
| WF-427c29e6 | ad-inserter < 1.5.6 |
MEDIUM | 4.8 | The Ad Inserter plugin for WordPress is vulnerable to Cross-Site Scripting via the 'ai-active-tab' parameter in versions… | 1.5.6 | wordfence |
| WF-4107199d | wp-job-portal < 2.2.3 |
MEDIUM | 4.8 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable … | 2.2.3 | wordfence |
| WF-40e61b9f | miniorange-limit-login-attempts < 4.0.72 |
MEDIUM | 4.8 | The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to ma… | 4.0.72 | wordfence |
| WF-3f8af7fd | facebook-conversion-pixel < 2.6.3 |
MEDIUM | 4.8 | The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users… | 2.6.3 | wordfence |
| WF-3eff7a6f | clickbank-ads-clickbank-widget < 1.35 |
MEDIUM | 4.8 | The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to… | 1.35 | wordfence |
| WF-3e76c4b3 | post-views-counter < 1.3.5 |
MEDIUM | 4.8 | The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which co… | 1.3.5 | wordfence |
| WF-3e2af005 | optimole-wp < 3.3.2 |
MEDIUM | 4.8 | The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload … | 3.3.2 | wordfence |
| WF-3d39ae72 | asgaros-forum < 1.15.14 |
MEDIUM | 4.8 | The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the na… | 1.15.14 | wordfence |
| WF-3d1f9fb7 | wp-downgrade < 1.2.3 |
MEDIUM | 4.8 | The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" set… | 1.2.3 | wordfence |
| WF-371fef9c | appointment-hour-booking < 1.3.56 |
MEDIUM | 4.8 | The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fiel… | 1.3.56 | wordfence |
| WF-33df558a | mark-posts < 2.0.1 |
MEDIUM | 4.8 | The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to… | 2.0.1 | wordfence |
| WF-2fa62862 | countdown-builder < 2.3.3 |
MEDIUM | 4.8 | Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock … | 2.3.3 | wordfence |
| WF-2f7d7ceb | slideshow-jquery-image-gallery | MEDIUM | 4.8 | The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which … | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →