Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 510 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-518771c1 | pie-register < 2.0.15 |
HIGH | 7.1 | The Pie Register plugin for WordPress is vulnerable to Cross-Site Scripting via the 'notice' parameter in versions befor… | 2.0.15 | wordfence |
| WF-501aed34 | job-manager < 0.7.25 |
HIGH | 7.1 | The Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘jobman-rating’ paramet… | 0.7.25 | wordfence |
| WF-4e381ad7 | archivist-custom-archive-templates < 1.7.5 |
HIGH | 7.1 | The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions … | 1.7.5 | wordfence |
| WF-4d154587 | change-table-prefix < 3.0 |
HIGH | 7.1 | The Change Table Prefix plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin… | 3.0 | wordfence |
| WF-4d153095 | careerfy < 4.4.0 |
HIGH | 7.1 | The Careerfy for WordPress is vulnerable to Reflected Cross-Site Scripting in versions before 4.4.0 due to insufficient … | 4.4.0 | wordfence |
| WF-4c425635 | track-that-stat < 1.1.0 |
HIGH | 7.1 | The Track That Stat plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 1.1.0 due to insuffici… | 1.1.0 | wordfence |
| WF-4a198600 | minterpress | HIGH | 7.1 | The Minterpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on a f… | — | wordfence |
| WF-49e4dc41 | wordpress-https | HIGH | 7.1 | The WordPress HTTPS (SSL) plugin is vulnerable to authenticated settings change in versions up to, and including, 3.4.0 … | — | wordfence |
| WF-49b466a2 | groupdocs-comparison < 1.0.3 |
HIGH | 7.1 | The GroupDocs.Comparison for Cloud plugin for WordPress is vulnerable to Cross-Site Scripting via several parameters in … | 1.0.3 | wordfence |
| WF-48e30af6 | hybrid < 0.10 |
HIGH | 7.1 | Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject… | 0.10 | wordfence |
| WF-477c6fa2 | go_pricing < 3.4 |
HIGH | 7.1 | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file u… | 3.4 | wordfence |
| WF-461d5d5a | ultimate-member < 1.3.0 |
HIGH | 7.1 | The Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in … | 1.3.0 | wordfence |
| WF-45323807 | eunice | HIGH | 7.1 | The Eunice theme for WordPress is vulnerable to Reflected Cross-Site Scripting via an unspecified parameter in all known… | — | wordfence |
| WF-42a642a8 | mainwp-post-dripper-extension < 4.0.5 |
HIGH | 7.1 | The MainWP Post Dripper Extension extension for WordPress is vulnerable to authorization bypass due to a missing capabil… | 4.0.5 | wordfence |
| WF-429fe34a | broken-link-checker < 2.4.1 |
HIGH | 7.1 | The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query… | 2.4.1 | wordfence |
| WF-416803bc | random-banner < 2.0 |
HIGH | 7.1 | Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.3 for WordPress allows remote attackers to inject… | 2.0 | wordfence |
| WF-413fa88f | fudousan-plugin | HIGH | 7.1 | Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.… | — | wordfence |
| WF-3fc5e9b3 | register-plus-redux | HIGH | 7.1 | The Register Plus Redux plugin for WordPress is vulnerable to Cross-Site Scripting in up to, and including 4.3 due to in… | — | wordfence |
| WF-3f5ff15d | yahoo-updates-for-wordpress | HIGH | 7.1 | Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plug… | — | wordfence |
| WF-3f2c97f4 | jet-engine < 3.2.5 |
HIGH | 7.1 | The JetEngine plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up… | 3.2.5 | wordfence |
| WF-3f11416c | campaign-monitor-wp < 2.5.6 |
HIGH | 7.1 | The Campaign Monitor Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa… | 2.5.6 | wordfence |
| WF-3dd8dac6 | embedded-video-with-link | HIGH | 7.1 | Cross-site scripting (XSS) vulnerability in embedded-video.php in the Embedded Video plugin 4.1 for WordPress allows rem… | — | wordfence |
| WF-396a7101 | slideshow-gallery-2 | HIGH | 7.1 | Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows re… | — | wordfence |
| WF-379408c3 | wp-members < 2.8.10 |
HIGH | 7.1 | The WP Members plugin for WordPress is vulnerable to Multiple Cross-Site Scripting via several parameters in versions be… | 2.8.10 | wordfence |
| WF-36fa1b11 | gf-excel-import < 1.18.1 |
HIGH | 7.1 | The Import Excel to Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions u… | 1.18.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →