Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 766 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-6979f943 | kirki < 6.0.12 |
MEDIUM | 6.4 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Requ… | 6.0.12 | wordfence |
| WF-696c379a | bdthemes-element-pack-lite < 5.6.12 |
MEDIUM | 6.4 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for W… | 5.6.12 | wordfence |
| WF-69695e2e | mycred < 2.7.3 |
MEDIUM | 6.4 | The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wrapper attribute in versions up to, an… | 2.7.3 | wordfence |
| WF-6963b3ed | upqode-google-maps | MEDIUM | 6.4 | The UpQode Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) i… | — | wordfence |
| WF-695563a6 | accordions < 2.3.25 |
MEDIUM | 6.4 | The Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion body field in all ver… | 2.3.25 | wordfence |
| WF-6953dea2 | responsive-header-image-slider | MEDIUM | 6.4 | The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsi… | — | wordfence |
| WF-6921da1b | mosaic | MEDIUM | 6.4 | The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the them… | — | wordfence |
| WF-6921c5a7 | adl-team | MEDIUM | 6.4 | The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, a… | — | wordfence |
| WF-691f86c2 | smart-mockups | MEDIUM | 6.4 | The Smart Mockups plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.… | — | wordfence |
| WF-691962c2 | modula-best-grid-gallery < 2.2.5 |
MEDIUM | 6.4 | A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation… | 2.2.5 | wordfence |
| WF-6915931e | sliderpro < 4.8.14 |
MEDIUM | 6.4 | The Slider Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.8.1… | 4.8.14 | wordfence |
| WF-690fd38c | exclusive-addons-for-elementor < 2.7.9.9 |
MEDIUM | 6.4 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title … | 2.7.9.9 | wordfence |
| WF-690e7f00 | gutenverse < 3.0.0 |
MEDIUM | 6.4 | The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored C… | 3.0.0 | wordfence |
| WF-68fd5e6f | ms-reviews | MEDIUM | 6.4 | The MS-Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in versions up… | — | wordfence |
| WF-68fb1fd3 | easy-pricing-tables < 3.2.7 |
MEDIUM | 6.4 | The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scri… | 3.2.7 | wordfence |
| WF-68f87cc7 | wordpress < 3.7.33 |
MEDIUM | 6.4 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the… | 3.7.33 | wordfence |
| WF-68f75333 | jb-horizontal-scroller-news-ticker | MEDIUM | 6.4 | The JB Horizontal Scroller News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up … | — | wordfence |
| WF-68f470ad | hide-text-shortcode | MEDIUM | 6.4 | The Hide Text Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi… | — | wordfence |
| WF-68e2f8ae | countdown-time < 1.2.7 |
MEDIUM | 6.4 | The Countdown Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, … | 1.2.7 | wordfence |
| WF-68ddc0a1 | wp-live-chat-software-for-wordpress < 3.7.4 |
MEDIUM | 6.4 | The WP LiveChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'livechat_email' option in ver… | 3.7.4 | wordfence |
| WF-68cdbe3e | fancytabs | MEDIUM | 6.4 | The FancyTabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all ver… | — | wordfence |
| WF-68cabb14 | qubely < 1.8.13 |
MEDIUM | 6.4 | The Qubely plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.12 du… | 1.8.13 | wordfence |
| WF-68c6e428 | royal-elementor-addons < 1.7.1013 |
MEDIUM | 6.4 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widg… | 1.7.1013 | wordfence |
| WF-68c190af | simple-wp-events < 1.9.0 |
MEDIUM | 6.4 | The Simple WP Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,… | 1.9.0 | wordfence |
| WF-68c16098 | mstw-league-manager | MEDIUM | 6.4 | The MSTW League Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →