Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 438 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-a5ed3612 | netreviews | HIGH | 7.2 | The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'modera… | — | wordfence |
| WF-a596c9c4 | ad-inserter < 2.7.11 |
HIGH | 7.2 | The Ad Inserter plugin for WordPress is vulnerable to Remote Code Execution in versions before 2.7.11 via the settings.p… | 2.7.11 | wordfence |
| WF-a57d218c | pods < 3.3.9 |
HIGH | 7.2 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versio… | 3.3.9 | wordfence |
| WF-a53a1178 | google-analytics-for-wordpress < 5.3.3 |
HIGH | 7.2 | The MonsterInsights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site… | 5.3.3 | wordfence |
| WF-a50e7042 | gravityforms < 2.10.1 |
HIGH | 7.2 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10… | 2.10.1 | wordfence |
| WF-a50e2df0 | videowhisper-live-streaming-integration < 7.1.3 |
HIGH | 7.2 | The Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Remote Code … | 7.1.3 | wordfence |
| WF-a4cbc1b4 | jetformbuilder < 3.6.8 |
HIGH | 7.2 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution i… | 3.6.8 | wordfence |
| WF-a4c8cf71 | crm-integration-freshworks-any-form < 1.0.16 |
HIGH | 7.2 | The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vu… | 1.0.16 | wordfence |
| WF-a4c604ec | jetformbuilder < 3.6.5.2 |
HIGH | 7.2 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in … | 3.6.5.2 | wordfence |
| WF-a4b46cb3 | smart-manager-for-wp-e-commerce < 8.91.0 |
HIGH | 7.2 | The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to Stored… | 8.91.0 | wordfence |
| WF-a4a3bc4b | custom-facebook-feed < 4.14.0 |
HIGH | 7.2 | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cr… | 4.14.0 | wordfence |
| WF-a47a8d0e | zippy | HIGH | 7.2 | The Zippy plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versio… | — | wordfence |
| WF-a4573514 | salon-booking-system < 10.31.6 |
HIGH | 7.2 | The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to St… | 10.31.6 | wordfence |
| WF-a453a38f | wp-payment-form < 4.2.1 |
HIGH | 7.2 | The Simple Payment Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and in… | 4.2.1 | wordfence |
| WF-a4522102 | ketchup-restaurant-reservations | HIGH | 7.2 | The Ketchup Restaurant Reservations plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to,… | — | wordfence |
| WF-a41c2ee9 | nextgen-gallery < 4.2.4 |
HIGH | 7.2 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-S… | 4.2.4 | wordfence |
| WF-a407d8b1 | grid-view-gallery | HIGH | 7.2 | The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1… | — | wordfence |
| WF-a3c36821 | awesome-filterable-portfolio < 1.9 |
HIGH | 7.2 | The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat… | 1.9 | wordfence |
| WF-a382aaa3 | everest-forms < 3.6.2 |
HIGH | 7.2 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vul… | 3.6.2 | wordfence |
| WF-a33a846c | woo-coupon-usage < 7.6.0 |
HIGH | 7.2 | The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scrip… | 7.6.0 | wordfence |
| WF-a330336e | ameliabooking < 2.2.1 |
HIGH | 7.2 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scri… | 2.2.1 | wordfence |
| WF-a328643a | usc-e-shop < 2.9.4 |
HIGH | 7.2 | The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up t… | 2.9.4 | wordfence |
| WF-a317395b | post-smtp < 2.8.7 |
HIGH | 7.2 | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for… | 2.8.7 | wordfence |
| WF-a2f9d282 | exact-links | HIGH | 7.2 | The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions… | — | wordfence |
| WF-a2f508f1 | traffic-manager | HIGH | 7.2 | The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'U… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →