Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 722 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-8f551441 | kimili-flash-embed | MEDIUM | 6.4 | The Kimili Flash Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin… | — | wordfence |
| WF-8f4b9647 | vk-google-job-posting-manager < 1.2.23 |
MEDIUM | 6.4 | The VK Google Job Posting Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a… | 1.2.23 | wordfence |
| WF-8f444df8 | pdf-generator-addon-for-elementor-page-builder < 2.2.0 |
MEDIUM | 6.4 | The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in … | 2.2.0 | wordfence |
| WF-8f3f3591 | fast-video-and-image-display | MEDIUM | 6.4 | The Fast Video and Image Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, an… | — | wordfence |
| WF-8f0cc587 | kali-forms < 2.4.13 |
MEDIUM | 6.4 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… | 2.4.13 | wordfence |
| WF-8f09f239 | demomentsomtres-shortcodes | MEDIUM | 6.4 | The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callo… | — | wordfence |
| WF-8f034716 | wp-photo-album-plus < 9.2.04.003 |
MEDIUM | 6.4 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 9.2.04.003 d… | 9.2.04.003 | wordfence |
| WF-8ef75bb4 | manager-for-icomoon < 2.2 |
MEDIUM | 6.4 | The Manager for Icomoon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's icomoon shor… | 2.2 | wordfence |
| WF-8ed90a91 | pretty-google-calendar < 1.6.0 |
MEDIUM | 6.4 | The Pretty Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(… | 1.6.0 | wordfence |
| WF-8ed413a9 | chart-expert | MEDIUM | 6.4 | The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in al… | — | wordfence |
| WF-8ed1f200 | recipe-card-blocks-by-wpzoom < 3.7.1 |
MEDIUM | 6.4 | The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' par… | 3.7.1 | wordfence |
| WF-8ecf826d | ultimate-member < 2.12.0 |
MEDIUM | 6.4 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plu… | 2.12.0 | wordfence |
| WF-8ec4eb8a | music-sheet-viewer | MEDIUM | 6.4 | The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' short… | — | wordfence |
| WF-8ec27c65 | royal-elementor-addons < 1.7.1070 |
MEDIUM | 6.4 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Stored C… | 1.7.1070 | wordfence |
| WF-8ea002da | learnpress < 4.2.6.5 |
MEDIUM | 6.4 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id va… | 4.2.6.5 | wordfence |
| WF-8e850339 | church-admin < 5.1.3 |
MEDIUM | 6.4 | The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all vers… | 5.1.3 | wordfence |
| WF-8e7b40e4 | bamboo-columns | MEDIUM | 6.4 | The Bamboo Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1… | — | wordfence |
| WF-8e796458 | services-section < 1.4.5 |
MEDIUM | 6.4 | The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored … | 1.4.5 | wordfence |
| WF-8e7831c5 | ad-inserter < 2.8.8 |
MEDIUM | 6.4 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custo… | 2.8.8 | wordfence |
| WF-8e75d72d | robo-gallery < 3.2.20 |
MEDIUM | 6.4 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | 3.2.20 | wordfence |
| WF-8e721128 | easy-liveblogs < 2.3.6 |
MEDIUM | 6.4 | The Easy Liveblogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elb_liveblog' sho… | 2.3.6 | wordfence |
| WF-8e65e06f | uncanny-learndash-toolkit < 3.7.0.3 |
MEDIUM | 6.4 | The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a… | 3.7.0.3 | wordfence |
| WF-8e618025 | znajdz-prace-z-pracapl | MEDIUM | 6.4 | The Znajdź Pracę z Praca.pl plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and i… | — | wordfence |
| WF-8e5417d3 | ht-mega-for-elementor < 2.4.7 |
MEDIUM | 6.4 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the … | 2.4.7 | wordfence |
| WF-8e501b31 | mshop-naver-talktalk < 1.2.1 |
MEDIUM | 6.4 | The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msntt_add… | 1.2.1 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →