🛡️ WordPress Vulnerability Database

Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.

46,645
Total CVEs
71
CISA KEV (Actively Exploited)
Nov 13, 2026
Last Updated

46,645 vulnerabilities found (page 629 of 1866)

CVE IDPlugin / ThemeSeverityCVSSDescriptionFixed InSource
WF-d9fe53e3 automatically-hierarchic-categories-in-menu
< 2.0.6 		MEDIUM 6.4 The Automatically Hierarchic Categories in Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting in ver… 2.0.6 wordfence
WF-d9f257a9 gamipress
< 7.9.9.2 		MEDIUM 6.4 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress i… 7.9.9.2 wordfence
WF-d9f1ea27 happy-elementor-addons
< 3.16.3 		MEDIUM 6.4 The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and … 3.16.3 wordfence
WF-d9ed939c ultimate-addons-for-gutenberg
< 2.12.9 		MEDIUM 6.4 The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu… 2.12.9 wordfence
WF-d9d37248 addons-for-elementor
< 8.3.6 		MEDIUM 6.4 The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ a… 8.3.6 wordfence
WF-d9d000ad loan-comparison
< 2.0.1 		MEDIUM 6.4 The Loan Comparison plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'loancomparison' … 2.0.1 wordfence
WF-d9c4e963 event-post
< 5.10.4 		MEDIUM 6.4 The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.10.… 5.10.4 wordfence
WF-d9af843e contextual-related-posts
< 3.3.1 		MEDIUM 6.4 The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block at… 3.3.1 wordfence
WF-d9a8d95c puzzleme
< 1.2.1 		MEDIUM 6.4 The PuzzleMe for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and incl… 1.2.1 wordfence
WF-d9a77b4f product-variation-swatches-for-woocommerce
< 2.1.2 		MEDIUM 6.4 The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several paramet… 2.1.2 wordfence
WF-d9a19e96 spiceforms-form-builder MEDIUM 6.4 The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' short… — wordfence
WF-d99d4b9a easy-facebook-likebox-premium MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… — wordfence
WF-d99d4b9a nextgen-gallery
< 3.59.5 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 3.59.5 wordfence
WF-d99d4b9a form-maker
< 1.15.28 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 1.15.28 wordfence
WF-d99d4b9a wp-carousel-free
< 2.6.9 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 2.6.9 wordfence
WF-d99d4b9a fancybox-for-wordpress
< 3.3.5 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 3.3.5 wordfence
WF-d99d4b9a the-plus-addons-for-block-editor
< 4.3.2 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 4.3.2 wordfence
WF-d99d4b9a easy-fancybox
< 2.3.4 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 2.3.4 wordfence
WF-d99d4b9a getwid
< 2.0.12 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 2.0.12 wordfence
WF-d99d4b9a visual-portfolio
< 3.3.10 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 3.3.10 wordfence
WF-d99d4b9a colibri-page-builder
< 1.0.288 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 1.0.288 wordfence
WF-d99d4b9a envira-gallery-lite
< 1.8.16 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 1.8.16 wordfence
WF-d99d4b9a fv-wordpress-flowplayer
< 7.5.48.7212 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 7.5.48.7212 wordfence
WF-d99d4b9a accordion-slider
< 1.9.13 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 1.9.13 wordfence
WF-d99d4b9a woo-smart-quick-view
< 4.1.2 		MEDIUM 6.4 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip… 4.1.2 wordfence
← Prev 626 627 628 629 630 631 632 Next →

Data sources and licences

Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.

Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.

CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.

  • Wordfence Intelligence: WordPress plugin, theme and core vulnerabilities. Free for commercial use under the Wordfence Intelligence terms.
  • MITRE CVE: CVE identifiers and descriptions.
  • National Vulnerability Database (NVD): This product uses data from the NVD API but is not endorsed or certified by the NVD. Used for WordPress components and Joomla core.
  • CISA Known Exploited Vulnerabilities: Vulnerabilities known to be exploited in the wild. US government data.
  • OSV.dev: Drupal and Packagist advisories: GitHub Advisory Database (CC BY 4.0) and the Drupal Security Team advisory database (MIT).
  • retire.js: Vulnerable JavaScript libraries and how to detect them. Apache License 2.0.
  • Joomla! Vulnerable Extensions List: Joomla extensions with known flaws. GNU GPL.
  • endoflife.date: End-of-life dates for platforms and runtimes. MIT licence.
  • WPScan: WordPress vulnerability data for popular plugins.

Is your WordPress site affected?

EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.

Scan My Website →
Scroll to Top