🛡️ WordPress Vulnerability Database

Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.

46,645
Total CVEs
71
CISA KEV (Actively Exploited)
Nov 13, 2026
Last Updated

46,645 vulnerabilities found (page 642 of 1866)

CVE IDPlugin / ThemeSeverityCVSSDescriptionFixed InSource
CVE-2026-2583 blocksy MEDIUM 6.4 The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in a… — nvd
CVE-2026-2486 master-addons-for-elementor MEDIUM 6.4 The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_tabl… — nvd
CVE-2026-2384 quiz-maker MEDIUM 6.4 The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortco… — nvd
CVE-2026-2383 simple-download-monitor MEDIUM 6.4 The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all ve… — nvd
CVE-2026-2367 secure-copy-content-protection-and-content-locking MEDIUM 6.4 The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting… — nvd
CVE-2026-2362 wp-accessibility
< 2.3.2 		MEDIUM 6.4 The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute… 2.3.2 nvd
CVE-2026-2029 livemesh-addons-for-beaver-builder MEDIUM 6.4 The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[labb_… — nvd
CVE-2026-1941 wp-event-aggregator MEDIUM 6.4 The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' s… — nvd
CVE-2026-1807 interactivecalculator-for-wordpress MEDIUM 6.4 The InteractiveCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… — nvd
CVE-2026-1646 advance-block-extend MEDIUM 6.4 The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attr… — nvd
CVE-2026-1373 easy-author-image MEDIUM 6.4 The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_… — nvd
CVE-2026-1236 envira-gallery-for-wordpress MEDIUM 6.4 The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_ga… — nvd
CVE-2026-0556 xo-event-calendar MEDIUM 6.4 The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field… — nvd
CVE-2026-0549 groups
< 3.11.0 		MEDIUM 6.4 The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortc… 3.11.0 nvd
CVE-2025-6460 display-during-conditional-shortcode MEDIUM 6.4 The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘me… — nvd
CVE-2025-14851 yamaps-for-wordpress MEDIUM 6.4 The YaMaps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `yamap` shortcode par… — nvd
CVE-2025-14445 image-hotspot-by-devvn MEDIUM 6.4 The Image Hotspot by DevVN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hotspot_content' c… — nvd
CVE-2025-14142 electric-enquiries MEDIUM 6.4 The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of t… — nvd
CVE-2025-14042 automotive-car-dealership-business-wordpress MEDIUM 6.4 The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via th… — nvd
CVE-2025-14040 automotive-car-dealership-business-wordpress MEDIUM 6.4 The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via th… — nvd
CVE-2025-13959 filestack MEDIUM 6.4 The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode … — nvd
CVE-2025-13738 easy-table-of-contents
< 2.0.79 		MEDIUM 6.4 The Easy Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ez-toc` s… 2.0.79 nvd
CVE-2025-13617 apollo13-framework-extensions MEDIUM 6.4 The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘a13_alt_l… — nvd
CVE-2025-13612 album-and-image-gallery-plus-lightbox MEDIUM 6.4 The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug… — nvd
CVE-2025-12375 printful-integration-for-woocommerce MEDIUM 6.4 The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versio… — nvd
← Prev 639 640 641 642 643 644 645 Next →

Data sources and licences

Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.

Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.

CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.

  • Wordfence Intelligence: WordPress plugin, theme and core vulnerabilities. Free for commercial use under the Wordfence Intelligence terms.
  • MITRE CVE: CVE identifiers and descriptions.
  • National Vulnerability Database (NVD): This product uses data from the NVD API but is not endorsed or certified by the NVD. Used for WordPress components and Joomla core.
  • CISA Known Exploited Vulnerabilities: Vulnerabilities known to be exploited in the wild. US government data.
  • OSV.dev: Drupal and Packagist advisories: GitHub Advisory Database (CC BY 4.0) and the Drupal Security Team advisory database (MIT).
  • retire.js: Vulnerable JavaScript libraries and how to detect them. Apache License 2.0.
  • Joomla! Vulnerable Extensions List: Joomla extensions with known flaws. GNU GPL.
  • endoflife.date: End-of-life dates for platforms and runtimes. MIT licence.
  • WPScan: WordPress vulnerability data for popular plugins.

Is your WordPress site affected?

EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.

Scan My Website →
Scroll to Top