Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1469 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-2e889182 | ultimate-reviews < 3.0.16 |
MEDIUM | 4.8 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (… | 3.0.16 | wordfence |
| WF-2e10e550 | shared-files < 1.6.57 |
MEDIUM | 4.8 | The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files … | 1.6.57 | wordfence |
| WF-2d853bd5 | wordpress < 3.7.16 |
MEDIUM | 4.8 | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress… | 3.7.16 | wordfence |
| WF-2bf29d3d | request-a-quote < 2.3.5 |
MEDIUM | 4.8 | The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admi… | 2.3.5 | wordfence |
| WF-2b346ae7 | simple-security < 1.1.6 |
MEDIUM | 4.8 | The Simple Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datefilter' parameter fou… | 1.1.6 | wordfence |
| WF-2a37a0e5 | interactive-medical-drawing-of-human-body < 2.4 |
MEDIUM | 4.8 | The Interactive Medical Drawing of Human Body WordPress plugin before 2.4 does not sanitise and escape the Link field, a… | 2.4 | wordfence |
| WF-29d962c0 | seo-redirection < 7.1 |
MEDIUM | 4.8 | The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 7.1 did not sanitise the Redirect From and R… | 7.1 | wordfence |
| WF-28cb1a04 | smooth-page-scroll-updown-buttons < 1.4 |
MEDIUM | 4.8 | The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, … | 1.4 | wordfence |
| WF-28bdf97b | wp-all-export < 1.3.1 |
MEDIUM | 4.8 | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputti… | 1.3.1 | wordfence |
| WF-217b4ed7 | wp-contact-slider < 2.4.7 |
MEDIUM | 4.8 | The WP Contact Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of sliders in v… | 2.4.7 | wordfence |
| WF-1f862575 | google-language-translator < 6.0.12 |
MEDIUM | 4.8 | The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some … | 6.0.12 | wordfence |
| WF-1e07562d | quotes-llama < 1.0.0 |
MEDIUM | 4.8 | The Quotes llama WordPress plugin through 0.7 does not sanitise and escape Quotes, which could allow high privilege user… | 1.0.0 | wordfence |
| WF-1d7860bf | easy-paypal-donation < 1.3.2 |
MEDIUM | 4.8 | The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created But… | 1.3.2 | wordfence |
| WF-1bf805fc | stop-spammer-registrations-plugin < 2021.18 |
MEDIUM | 4.8 | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of i… | 2021.18 | wordfence |
| WF-1abdc53b | toggle-the-title | MEDIUM | 4.8 | The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=upda… | — | wordfence |
| WF-18afd787 | wp-super-cache < 1.7.3 |
MEDIUM | 4.8 | The Twitter Bootstrap Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_cache_locatio… | 1.7.3 | wordfence |
| WF-188d812c | webp-converter-for-media < 6.5.2 |
MEDIUM | 4.8 | The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Requ… | 6.5.2 | wordfence |
| WF-171ee69a | bulletproof-security < .52.5 |
MEDIUM | 4.8 | In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPres… | .52.5 | wordfence |
| WF-15aba6ee | buttonizer-multifunctional-button < 2.5.5 |
MEDIUM | 4.8 | The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before out… | 2.5.5 | wordfence |
| WF-15705cf2 | chaty < 2.8.5 |
MEDIUM | 4.8 | Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plu… | 2.8.5 | wordfence |
| WF-14b334ee | responsive-tabs < 4.0.6 |
MEDIUM | 4.8 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress… | 4.0.6 | wordfence |
| WF-1212dfc7 | bookingcom-product-helper < 1.0.2 |
MEDIUM | 4.8 | The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Pro… | 1.0.2 | wordfence |
| WF-11401ad7 | cookie-bar < 1.8.9 |
MEDIUM | 4.8 | The Cookie Bar WordPress plugin through 1.8.8 doesn't properly sanitise the Cookie Bar Message setting, which could allo… | 1.8.9 | wordfence |
| WF-1072ad88 | wp-all-import < 3.6.8 |
MEDIUM | 4.8 | The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip… | 3.6.8 | wordfence |
| WF-0d3fa716 | wp-browser-update < 4.6 |
MEDIUM | 4.8 | The WP BrowserUpdate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple parameters in ve… | 4.6 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →