Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 694 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-a6e3645d | wordpress-seo-premium < 26.0 |
MEDIUM | 6.4 | The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to … | 26.0 | wordfence |
| WF-a6df96a3 | astra-widgets < 1.2.16 |
MEDIUM | 6.4 | The Astra Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.… | 1.2.16 | wordfence |
| WF-a6da4cf6 | contact-form-7-datepicker | MEDIUM | 6.4 | Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minim… | — | wordfence |
| WF-a6d663a9 | rafflepress < 1.12.2 |
MEDIUM | 6.4 | The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'raf… | 1.12.2 | wordfence |
| WF-a6cee2c1 | infusionsoft-official-opt-in-forms | MEDIUM | 6.4 | The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and … | — | wordfence |
| WF-a6c976fd | tlp-team < 6.0.3 |
MEDIUM | 6.4 | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp… | 6.0.3 | wordfence |
| WF-a6be4aaa | foogallery < 2.4.32 |
MEDIUM | 6.4 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnera… | 2.4.32 | wordfence |
| WF-a6be4565 | eazydocs < 2.5.1 |
MEDIUM | 6.4 | The EazyDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 d… | 2.5.1 | wordfence |
| WF-a6b5cca3 | logo-slider-wp < 5.5.4 |
MEDIUM | 6.4 | The Logo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.… | 5.5.4 | wordfence |
| WF-a69e9802 | foogallery < 2.4.16 |
MEDIUM | 6.4 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a… | 2.4.16 | wordfence |
| WF-a69a99af | fusedesk < 6.7 |
MEDIUM | 6.4 | The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' short… | 6.7 | wordfence |
| WF-a684f597 | dominion-domain-checker-wpbakery-addon | MEDIUM | 6.4 | The Dominion – Domain Checker for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p… | — | wordfence |
| WF-a684bf5f | recipe-card-blocks-by-wpzoom < 3.4.14 |
MEDIUM | 6.4 | The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'su… | 3.4.14 | wordfence |
| WF-a6811f19 | elisqlreports < 5.25.25 |
MEDIUM | 6.4 | The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via … | 5.25.25 | wordfence |
| WF-a67df40b | themify-portfolio-post < 1.2.1 |
MEDIUM | 6.4 | The Themify Portfolio Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes… | 1.2.1 | wordfence |
| WF-a67b4ec2 | list-attachments-shortcode | MEDIUM | 6.4 | The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' p… | — | wordfence |
| WF-a66bc196 | download-manager < 3.2.71 |
MEDIUM | 6.4 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_log… | 3.2.71 | wordfence |
| WF-a66b55e0 | wp-applicantstack-jobs-display | MEDIUM | 6.4 | The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attri… | — | wordfence |
| WF-a666d0e4 | bukazu-search-widget < 3.5 |
MEDIUM | 6.4 | The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter… | 3.5 | wordfence |
| WF-a660b7b8 | donorbox-donation-form < 7.1.2 |
MEDIUM | 6.4 | The Donorbox plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 7.1.1 via stor… | 7.1.2 | wordfence |
| WF-a65fe73b | wp-joomag | MEDIUM | 6.4 | The WP Joomag plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 … | — | wordfence |
| WF-a659866a | rrssb | MEDIUM | 6.4 | The RRSSB plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.1 due … | — | wordfence |
| WF-a654ee62 | 360-sphere-images | MEDIUM | 6.4 | The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortc… | — | wordfence |
| WF-a64c67de | ultimate-addons-for-elementor | MEDIUM | 6.4 | The Mega Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and i… | — | wordfence |
| WF-a63d6a64 | happy-elementor-addons < 3.12.1 |
MEDIUM | 6.4 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and … | 3.12.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →