Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 414 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-e18b3a85 | searchterms-tagging-2 | HIGH | 7.2 | The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms coun… | — | wordfence |
| WF-e1523ba0 | google-analyticator < 6.5.6 |
HIGH | 7.2 | The Google Analyticator plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.5… | 6.5.6 | wordfence |
| WF-e13e6e17 | ad-inserter < 2.8.20 |
HIGH | 7.2 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all ve… | 2.8.20 | wordfence |
| WF-e11c9f2c | simply-schedule-appointments < 1.6.12.4 |
HIGH | 7.2 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, an… | 1.6.12.4 | wordfence |
| WF-e11662b0 | wp-useronline < 2.88.3 |
HIGH | 7.2 | The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in … | 2.88.3 | wordfence |
| WF-e10e3382 | mobile-app-editor | HIGH | 7.2 | The Mobile App Editor – WordPress to Android App Builder plugin for WordPress is vulnerable to arbitrary file uploads … | — | wordfence |
| WF-e10c0d8d | super-simple-contact-form | HIGH | 7.2 | The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscf_name' p… | — | wordfence |
| WF-e0d9b77d | templatespare < 4.2.1 |
HIGH | 7.2 | The TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Bui… | 4.2.1 | wordfence |
| WF-e0d6ef49 | pretty-link < 1.6.3 |
HIGH | 7.2 | Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in … | 1.6.3 | wordfence |
| WF-e0cf5711 | safe-editor < 1.2 |
HIGH | 7.2 | The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. | 1.2 | wordfence |
| WF-e08c3db4 | similar-posts < 3.1.6 |
HIGH | 7.2 | The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened… | 3.1.6 | wordfence |
| WF-e08a8609 | fediverse-embeds < 1.5.8 |
HIGH | 7.2 | The Fediverse Embeds plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including,… | 1.5.8 | wordfence |
| WF-e06fbb3b | fv-wordpress-flowplayer < 7.5.55.7212 |
HIGH | 7.2 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcod… | 7.5.55.7212 | wordfence |
| WF-e05d4320 | popup-maker < 1.23.0 |
HIGH | 7.2 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPres… | 1.23.0 | wordfence |
| WF-e02e8d8d | survey-maker < 5.1.8.9 |
HIGH | 7.2 | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.1… | 5.1.8.9 | wordfence |
| WF-dfe07cd7 | post-content-xmlrpc | HIGH | 7.2 | The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before usi… | — | wordfence |
| WF-dfcc3d8c | google-analyticator < 6.5.6 |
HIGH | 7.2 | The Google Analyticator plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.5… | 6.5.6 | wordfence |
| WF-dfc3c6b2 | wp-associate-post-r2 < 5.0.2 |
HIGH | 7.2 | The WP Associate Post R2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and in… | 5.0.2 | wordfence |
| WF-dfb2dda8 | roomcloud < 1.3 |
HIGH | 7.2 | Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress al… | 1.3 | wordfence |
| WF-dfaf1b9e | vikrentcar < 1.4.8 |
HIGH | 7.2 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all ver… | 1.4.8 | wordfence |
| WF-df97321f | fluent-crm < 3.1.8 |
HIGH | 7.2 | The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin… | 3.1.8 | wordfence |
| WF-df6cbc36 | wp-yelp-review-slider < 9.3 |
HIGH | 7.2 | The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (import… | 9.3 | wordfence |
| WF-df657cdc | wp-cerber < 2.7 |
HIGH | 7.2 | The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header when "I'm behind a proxy" opti… | 2.7 | wordfence |
| WF-df406e59 | woo-checkout-field-editor-pro < 2.1.8 |
HIGH | 7.2 | The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scr… | 2.1.8 | wordfence |
| WF-dee712ce | radio-player < 2.0.85 |
HIGH | 7.2 | The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerabl… | 2.0.85 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →