Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1040 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-80b6f2e6 | hostel < 1.1.5.3 |
MEDIUM | 6.1 | The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'offset' and 'type' parameters i… | 1.1.5.3 | wordfence |
| WF-80b31295 | wp-support-plus-responsive-ticket-system < 9.1.2 |
MEDIUM | 6.1 | A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Tick… | 9.1.2 | wordfence |
| WF-80a627a5 | animal-captcha | MEDIUM | 6.1 | The Animal Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘num’ parameter in v… | — | wordfence |
| WF-80a5fac0 | the-ultralight | MEDIUM | 6.1 | The UltraLight theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.2… | — | wordfence |
| WF-809fe65f | socialfit | MEDIUM | 6.1 | The SocialFit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including,… | — | wordfence |
| WF-809d0632 | wordfence < 6.1.7 |
MEDIUM | 6.1 | The Wordfence plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘adminURL’ parameter in v… | 6.1.7 | wordfence |
| WF-80871684 | comments-capcha-box | MEDIUM | 6.1 | The Comments Capcha Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and … | — | wordfence |
| WF-807f895e | tagmaker | MEDIUM | 6.1 | The WP-tagMaker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and includin… | — | wordfence |
| WF-8073cc59 | mapsvg-lite-interactive-vector-maps < 3.3.0 |
MEDIUM | 6.1 | MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/a… | 3.3.0 | wordfence |
| WF-807345dc | totalcontest-lite < 2.9.0 |
MEDIUM | 6.1 | The Photo Contest | Competition | Video Contest plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in… | 2.9.0 | wordfence |
| WF-8070a920 | terms-of-use-2 | MEDIUM | 6.1 | The Terms of Use plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, … | — | wordfence |
| WF-806bbfb8 | photo-gallery < 1.8.3 |
MEDIUM | 6.1 | The Photo Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8… | 1.8.3 | wordfence |
| WF-8069e16d | white-label-cms < 2.7.5 |
MEDIUM | 6.1 | The White Label CMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includin… | 2.7.5 | wordfence |
| WF-8063a545 | social-networks-auto-poster-facebook-twitter-g < 4.4.4 |
MEDIUM | 6.1 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the H… | 4.4.4 | wordfence |
| WF-805a7bef | organizer | MEDIUM | 6.1 | Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPr… | — | wordfence |
| WF-8059ea88 | exchange-addon-easy-canadian-sales-taxes < 1.1.0 |
MEDIUM | 6.1 | Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_… | 1.1.0 | wordfence |
| WF-805311c4 | arconix-shortcodes < 2.1.17 |
MEDIUM | 6.1 | The Arconix Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inclu… | 2.1.17 | wordfence |
| WF-8051fb03 | bp-profile-search < 5.6 |
MEDIUM | 6.1 | The BP Profile Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ BPS_FORM’ param… | 5.6 | wordfence |
| WF-8049bff1 | seers-cookie-consent-banner-privacy-policy < 8.1.1 |
MEDIUM | 6.1 | The Seers | GDPR & CCPA Cookie Consent & Compliance plugin for WordPress is vulnerable to Cross-Site Request Forgery in … | 8.1.1 | wordfence |
| WF-8036bd83 | litespeed-cache < 6.3 |
MEDIUM | 6.1 | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… | 6.3 | wordfence |
| WF-80328a83 | woo-store-mode | MEDIUM | 6.1 | The Woo Store Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and inclu… | — | wordfence |
| WF-8027fa07 | phastpress < 1.111 |
MEDIUM | 6.1 | There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request t… | 1.111 | wordfence |
| WF-80203516 | staff-directory-pro | MEDIUM | 6.1 | The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t… | — | wordfence |
| WF-800a06f3 | updraftplus < 1.9.6.4 |
MEDIUM | 6.1 | The UpdraftPlus WordPress plugin for WordPress is vulnerable to Cross-Site Scripting via the 'add_query_arg()' and 'remo… | 1.9.6.4 | wordfence |
| WF-80098d80 | simple-matted-thumbnails | MEDIUM | 6.1 | The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVE… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →