🛡️ WordPress Vulnerability Database

Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.

46,645
Total CVEs
71
CISA KEV (Actively Exploited)
Nov 13, 2026
Last Updated

46,645 vulnerabilities found (page 686 of 1866)

CVE IDPlugin / ThemeSeverityCVSSDescriptionFixed InSource
WF-ace85b25 css-javascript-toolbox
< 11.9 		MEDIUM 6.4 The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcod… 11.9 wordfence
WF-acd7b1b5 shopengine
< 4.9.6 		MEDIUM 6.4 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Wi… 4.9.6 wordfence
WF-accdcff0 woocommerce-brands
< 1.6.46 		MEDIUM 6.4 The WooCommerce Brands plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '[product_bran… 1.6.46 wordfence
WF-accd4f34 buddyforms
< 2.8.14 		MEDIUM 6.4 The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (… 2.8.14 wordfence
WF-acc073ed elementor
< 4.3.6 		MEDIUM 6.4 The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Stored Cross-Site … 4.3.6 wordfence
WF-acaadf62 links-shortcode MEDIUM 6.4 The Links shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, … — wordfence
WF-acaad554 picture-gallery
< 1.5.12 		MEDIUM 6.4 The Picture Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, … 1.5.12 wordfence
WF-acaa3142 gallery-with-thumbnail-slider MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… — wordfence
WF-acaa3142 portfolio-wp
< 2.2.2 		MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… 2.2.2 wordfence
WF-acaa3142 image-hover-effects-ultimate MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… — wordfence
WF-acaa3142 lightgallerywp MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… — wordfence
WF-acaa3142 onepress MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… — wordfence
WF-acaa3142 royal-elementor-addons
< 1.7.1032 		MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… 1.7.1032 wordfence
WF-acaa3142 tp-woocommerce-product-gallery
< 2.0.0 		MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… 2.0.0 wordfence
WF-acaa3142 ibtana-visual-editor
< 1.2.5.2 		MEDIUM 6.4 Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ligh… 1.2.5.2 wordfence
WF-aca48ddf subpage-view MEDIUM 6.4 The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode… — wordfence
WF-ac909a4b gutenverse
< 3.6.0 		MEDIUM 6.4 The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Re… 3.6.0 wordfence
WF-ac8a8698 youzify
< 1.0.7 		MEDIUM 6.4 The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin … 1.0.7 wordfence
WF-ac87819d mailchimp-forms-by-mailmunch
< 3.2.3 		MEDIUM 6.4 The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shor… 3.2.3 wordfence
WF-ac7f95c7 wpadcenter
< 2.5.7 		MEDIUM 6.4 … 2.5.7 wordfence
WF-ac7aeb6a data-visualizer MEDIUM 6.4 The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' short… — wordfence
WF-ac7263c6 wired-impact-volunteer-management
< 2.5.1 		MEDIUM 6.4 The Wired Impact Volunteer Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up t… 2.5.1 wordfence
WF-ac5d941c greencon MEDIUM 6.4 The GreenCon plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.1 d… — wordfence
WF-ac422162 ultimate-blocks
< 3.2.8 		MEDIUM 6.4 The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… 3.2.8 wordfence
WF-ac41a122 bold-page-builder
< 5.1.2 		MEDIUM 6.4 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including… 5.1.2 wordfence
← Prev 683 684 685 686 687 688 689 Next →

Data sources and licences

Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.

Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.

CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.

  • Wordfence Intelligence: WordPress plugin, theme and core vulnerabilities. Free for commercial use under the Wordfence Intelligence terms.
  • MITRE CVE: CVE identifiers and descriptions.
  • National Vulnerability Database (NVD): This product uses data from the NVD API but is not endorsed or certified by the NVD. Used for WordPress components and Joomla core.
  • CISA Known Exploited Vulnerabilities: Vulnerabilities known to be exploited in the wild. US government data.
  • OSV.dev: Drupal and Packagist advisories: GitHub Advisory Database (CC BY 4.0) and the Drupal Security Team advisory database (MIT).
  • retire.js: Vulnerable JavaScript libraries and how to detect them. Apache License 2.0.
  • Joomla! Vulnerable Extensions List: Joomla extensions with known flaws. GNU GPL.
  • endoflife.date: End-of-life dates for platforms and runtimes. MIT licence.
  • WPScan: WordPress vulnerability data for popular plugins.

Is your WordPress site affected?

EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.

Scan My Website →
Scroll to Top