Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 855 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-204cfe20 | elementskit < 3.7.9 |
MEDIUM | 6.4 | The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parame… | 3.7.9 | wordfence |
| WF-203f850e | quick-paypal-payments < 6.0.5 |
MEDIUM | 6.4 | The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t… | 6.0.5 | wordfence |
| WF-203ab09f | happy-elementor-addons < 3.10.9 |
MEDIUM | 6.4 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ param… | 3.10.9 | wordfence |
| WF-20378a65 | scrollbar-by-webxapp | MEDIUM | 6.4 | The Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin plugin for WordPress is vulnerable to Stored Cro… | — | wordfence |
| WF-20301685 | campus-directory < 1.9.1 |
MEDIUM | 6.4 | The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to S… | 1.9.1 | wordfence |
| WF-202dfb5c | mega-elements-addons-for-elementor < 1.2.7 |
MEDIUM | 6.4 | The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.… | 1.2.7 | wordfence |
| WF-20283c28 | wpmu < 2.6 |
MEDIUM | 6.4 | Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attack… | 2.6 | wordfence |
| WF-20262161 | ultimate-wp-mail < 1.3.9 |
MEDIUM | 6.4 | The Ultimate WP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,… | 1.3.9 | wordfence |
| WF-20232d70 | elementor < 3.35.6 |
MEDIUM | 6.4 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site … | 3.35.6 | wordfence |
| WF-20227433 | wp-mailup < 1.3.2 |
MEDIUM | 6.4 | ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax… | 1.3.2 | wordfence |
| WF-201ff7b6 | royal-elementor-addons < 1.7.1029 |
MEDIUM | 6.4 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all… | 1.7.1029 | wordfence |
| WF-20199c88 | anual-archive | MEDIUM | 6.4 | The Annual Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1… | — | wordfence |
| WF-2011db9d | wp-bibtex | MEDIUM | 6.4 | The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in… | — | wordfence |
| WF-200f6173 | business-directory-plugin < 6.4.25 |
MEDIUM | 6.4 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Stored Cr… | 6.4.25 | wordfence |
| WF-20042ecf | wpdm-premium-packages < 7.3.0 |
MEDIUM | 6.4 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… | 7.3.0 | wordfence |
| WF-2003cef3 | site-reviews < 6.11.7 |
MEDIUM | 6.4 | The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.1… | 6.11.7 | wordfence |
| WF-2002fa81 | careerfy < 4.0.0 |
MEDIUM | 6.4 | The Careerfy - Job Board WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caree… | 4.0.0 | wordfence |
| WF-1ff77089 | wptelegram-widget < 2.1.28 |
MEDIUM | 6.4 | The WP Telegram Widget and Join Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to… | 2.1.28 | wordfence |
| WF-1febe2d8 | graphina-elementor-charts-and-graphs < 1.8.10 |
MEDIUM | 6.4 | The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multi… | 1.8.10 | wordfence |
| WF-1fdc5c50 | uichemy < 5.4.0 |
MEDIUM | 6.4 | The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerab… | 5.4.0 | wordfence |
| WF-1fdbddd7 | fpw-category-thumbnails | MEDIUM | 6.4 | The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of … | — | wordfence |
| WF-1fdb1314 | wot-elementor-widgets | MEDIUM | 6.4 | The Wot Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inclu… | — | wordfence |
| WF-1fd45d76 | wp-github | MEDIUM | 6.4 | The WP Github plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.3 … | — | wordfence |
| WF-1fce3120 | mail-subscribe-list | MEDIUM | 6.4 | The Mail Subscribe List plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi… | — | wordfence |
| WF-1fc860d4 | cbxgooglemap < 1.1.12 |
MEDIUM | 6.4 | The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions… | 1.1.12 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →