Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 688 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-aba393f5 | jet-elements < 2.7.12.1 |
MEDIUM | 6.4 | The JetElements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and i… | 2.7.12.1 | wordfence |
| WF-ab97f125 | interactions < 1.3.2 |
MEDIUM | 6.4 | The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cro… | 1.3.2 | wordfence |
| WF-ab8ed134 | contact-form-with-a-meeting-scheduler-by-vcita < 4.10.5 |
MEDIUM | 6.4 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a… | 4.10.5 | wordfence |
| WF-ab8dfdd8 | bdthemes-element-pack-lite < 5.11.3 |
MEDIUM | 6.4 | The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Bu… | 5.11.3 | wordfence |
| WF-ab8ce4cf | mp-timetable < 2.4.2 |
MEDIUM | 6.4 | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a times… | 2.4.2 | wordfence |
| WF-ab888ee1 | easy-social-icons < 3.2.5 |
MEDIUM | 6.4 | The Easy Social Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in… | 3.2.5 | wordfence |
| WF-ab856722 | ipushpull < 2.3.3 |
MEDIUM | 6.4 | The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpul… | 2.3.3 | wordfence |
| WF-ab777672 | post-grid < 2.2.65 |
MEDIUM | 6.4 | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the c… | 2.2.65 | wordfence |
| WF-ab747c34 | angel | MEDIUM | 6.4 | The Angel – Fashion Model Agency WordPress CMS Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting … | — | wordfence |
| WF-ab66ac69 | wordpress < 3.5.1 |
MEDIUM | 6.4 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary… | 3.5.1 | wordfence |
| WF-ab664bc5 | marquee-addons-for-elementor < 3.0.0 |
MEDIUM | 6.4 | The MarqueeAddons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial Marquee… | 3.0.0 | wordfence |
| WF-ab650b99 | schema-and-structured-data-for-wp < 1.34.1 |
MEDIUM | 6.4 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug… | 1.34.1 | wordfence |
| WF-ab63f507 | spin360 | MEDIUM | 6.4 | The Spin 360 deg and 3D Model Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to… | — | wordfence |
| WF-ab5f43c0 | addon-elements-for-elementor-page-builder < 1.13.6 |
MEDIUM | 6.4 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ paramet… | 1.13.6 | wordfence |
| WF-ab5e4b3b | jet-elements < 2.9.2.7 |
MEDIUM | 6.4 | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, … | 2.9.2.7 | wordfence |
| WF-ab5e09d8 | visual-portfolio < 3.3.3 |
MEDIUM | 6.4 | The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… | 3.3.3 | wordfence |
| WF-ab5b7dc4 | email-address-encoder < 1.0.23 |
MEDIUM | 6.4 | The Email Address Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eae_shortco… | 1.0.23 | wordfence |
| WF-ab58cd01 | featured-image-with-url < 1.0.6 |
MEDIUM | 6.4 | The Featured Image with URL plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 1.0.… | 1.0.6 | wordfence |
| WF-ab518a1b | eg-series | MEDIUM | 6.4 | The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in a… | — | wordfence |
| WF-ab4e8423 | renden | MEDIUM | 6.4 | The Renden theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, an… | — | wordfence |
| WF-ab478a98 | seedprod-coming-soon-pro-5 < 6.19.5 |
MEDIUM | 6.4 | The SeedProd Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 6.19.5 due to insuf… | 6.19.5 | wordfence |
| WF-ab4149e1 | simple-embed-code < 2.5 |
MEDIUM | 6.4 | The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functiona… | 2.5 | wordfence |
| WF-ab3176b5 | semantic-shortcode | MEDIUM | 6.4 | The Semantic Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin… | — | wordfence |
| WF-ab29af00 | bold-page-builder < 5.4.2 |
MEDIUM | 6.4 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including… | 5.4.2 | wordfence |
| WF-ab19f7b1 | suretriggers < 1.0.48 |
MEDIUM | 6.4 | The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to … | 1.0.48 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →