Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1037 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-835db0c0 | wp-facethumb | MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote… | — | wordfence |
| WF-835cbcfa | hk-exif-tags < 1.12 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticate… | 1.12 | wordfence |
| WF-83556ba7 | td-composer < 5.4.6 |
MEDIUM | 6.1 | The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includin… | 5.4.6 | wordfence |
| WF-834ff44a | docket-cache < 21.08.02 |
MEDIUM | 6.1 | The Docket Cache – Object Cache Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via t… | 21.08.02 | wordfence |
| WF-834e86c6 | simple-student-result < 1.7.5 |
MEDIUM | 6.1 | The Student Result or Employee Database plugin for WordPress is vulnerable to Cross-Site Request Forgery on its ajax act… | 1.7.5 | wordfence |
| WF-8321c669 | filled-in < 1.9.3 |
MEDIUM | 6.1 | The Filled In plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9… | 1.9.3 | wordfence |
| WF-83157b37 | updater < 1.35 |
MEDIUM | 6.1 | The Updater by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and i… | 1.35 | wordfence |
| WF-83145c07 | rws-enquiry | MEDIUM | 6.1 | The RWS Enquiry And Lead Follow-up plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up t… | — | wordfence |
| WF-83106660 | enfold < 5.6.10 |
MEDIUM | 6.1 | The Enfold theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.6.9 d… | 5.6.10 | wordfence |
| WF-830baa14 | 5centscdn | MEDIUM | 6.1 | The 5centsCDN plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 25.… | — | wordfence |
| WF-8306090a | persian-woocommerce-sms < 7.0.6 |
MEDIUM | 6.1 | The Persian Woocommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and … | 7.0.6 | wordfence |
| WF-8305be9c | download-monitor < 1.7.1 |
MEDIUM | 6.1 | The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. | 1.7.1 | wordfence |
| WF-8303c84f | hunk-external-links | MEDIUM | 6.1 | The Hunk External Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘hr’ parameter … | — | wordfence |
| WF-82fe99af | civicrm < 5.28.1 |
MEDIUM | 6.1 | The CiviCRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via improper CSRF checks in the CKEditor C… | 5.28.1 | wordfence |
| WF-82f525c9 | tinymce-extended-config | MEDIUM | 6.1 | The TinyMCE Extended Config plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, … | — | wordfence |
| WF-82f214e3 | wp-ad-management | MEDIUM | 6.1 | The Ads24 Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.… | — | wordfence |
| WF-82e9bd78 | wemail < 1.14.6 |
MEDIUM | 6.1 | The weMail plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.14.5… | 1.14.6 | wordfence |
| WF-82e235ac | the-world | MEDIUM | 6.1 | The The World plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4… | — | wordfence |
| WF-82df5b2e | luckywp-table-of-contents < 2.1.11 |
MEDIUM | 6.1 | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, an… | 2.1.11 | wordfence |
| WF-82da75f4 | 2-click-socialmedia-buttons < 0.34 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for Wor… | 0.34 | wordfence |
| WF-82d6fc5d | wpfilesearch | MEDIUM | 6.1 | The WordPress File Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and in… | — | wordfence |
| WF-82caf69a | tm-wordpress-redirection | MEDIUM | 6.1 | The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,… | — | wordfence |
| WF-82c6ed2f | wpdirectorykit < 1.2.0 |
MEDIUM | 6.1 | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, … | 1.2.0 | wordfence |
| WF-82b48e39 | litespeed-cache < 4.4.4 |
MEDIUM | 6.1 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'qc_res' parameter in v… | 4.4.4 | wordfence |
| WF-82b45bd5 | wordpress-theme-demo-bar | MEDIUM | 6.1 | The Theme Demo Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →