Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 451 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-821462d6 | greenshift-animation-and-page-builder-blocks < 7.6.3 |
HIGH | 7.2 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to… | 7.6.3 | wordfence |
| WF-81fa4987 | geodirectory < 2.2.24 |
HIGH | 7.2 | The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the 'selected', 'post_type' parameters in versi… | 2.2.24 | wordfence |
| WF-81f993ec | free-sales-funnel-squeeze-pages-landing-page-builder-templates-make < 0.99 |
HIGH | 7.2 | An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page temp… | 0.99 | wordfence |
| WF-816fb31d | design-comuni-wordpress-theme < 1.1.2 |
HIGH | 7.2 | The Design Comuni Italia theme for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.1.1 due to insuff… | 1.1.2 | wordfence |
| WF-8169a655 | video-playlist-and-gallery-plugin | HIGH | 7.2 | The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up… | — | wordfence |
| WF-8139bc38 | adminer < 1.4.4 |
HIGH | 7.2 | The Adminer plugin for WordPress is vulnerable to Cross-Site Scripting in the altar table versions up to, and including,… | 1.4.4 | wordfence |
| WF-80d976f3 | advanced-xml-reader | HIGH | 7.2 | The Advanced XML Reader plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in versions up to, and… | — | wordfence |
| WF-80d3ceea | mangboard < 2.3.5 |
HIGH | 7.2 | The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.… | 2.3.5 | wordfence |
| WF-80848de3 | uncanny-automator < 7.1.0 |
HIGH | 7.2 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulne… | 7.1.0 | wordfence |
| WF-8058ea74 | dewa-kirim-woocommerce-gojek | HIGH | 7.2 | The Dewa Kirim plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1… | — | wordfence |
| WF-804cfd49 | radio-player | HIGH | 7.2 | The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player plugin for WordPress is vulnerable to Server-Si… | — | wordfence |
| WF-804b42a0 | boldgrid-backup < 1.16.7 |
HIGH | 7.2 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Re… | 1.16.7 | wordfence |
| WF-8044951e | userswp < 1.2.74 |
HIGH | 7.2 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordP… | 1.2.74 | wordfence |
| WF-80153f79 | woo-abandoned-cart-recovery < 1.1.11 |
HIGH | 7.2 | The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version… | 1.1.11 | wordfence |
| WF-7fdc5bc4 | tourmaster < 5.4.8 |
HIGH | 7.2 | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versi… | 5.4.8 | wordfence |
| WF-7e89b33e | asf-allow-svg-files < 1.1 |
HIGH | 7.2 | The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privil… | 1.1 | wordfence |
| WF-7e898e40 | subscriptions-for-woocommerce < 2.0.1 |
HIGH | 7.2 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and… | 2.0.1 | wordfence |
| WF-7e8911a3 | post-smtp < 2.8.8 |
HIGH | 7.2 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress… | 2.8.8 | wordfence |
| WF-7e7b24b5 | eps-301-redirects < 2.51 |
HIGH | 7.2 | Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise … | 2.51 | wordfence |
| WF-7e78d678 | svg-vector-icon-plugin | HIGH | 7.2 | The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing a high p… | — | wordfence |
| WF-7e6a0bf9 | meeting-scheduler-by-vcita < 4.3.1 |
HIGH | 7.2 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site … | 4.3.1 | wordfence |
| WF-7e3ad5fd | simply-schedule-appointments < 1.6.11.0 |
HIGH | 7.2 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to S… | 1.6.11.0 | wordfence |
| WF-7e3322f0 | usc-e-shop < 2.12.7 |
HIGH | 7.2 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and incl… | 2.12.7 | wordfence |
| WF-7e0a6ba5 | schema-app-structured-data-for-schemaorg | HIGH | 7.2 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via… | — | wordfence |
| WF-7e092d67 | webpushr-web-push-notifications < 4.35.0 |
HIGH | 7.2 | The Web Push Notifications – Webpushr plugin for WordPress is vulnerable to unauthorized modification of data due to a… | 4.35.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →