Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1101 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-4197dd30 | favicon-rotator < 1.2.11 |
MEDIUM | 6.1 | The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and incl… | 1.2.11 | wordfence |
| WF-4196b8d1 | featured-posts-scroll | MEDIUM | 6.1 | The Featured Posts Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in… | — | wordfence |
| WF-4187f559 | wordpress-seo < 2.2 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for Wor… | 2.2 | wordfence |
| WF-4186fe8d | wp-google-map-plugin < 4.1.0 |
MEDIUM | 6.1 | The WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps plugin for WordPress is vulnerable to Reflected… | 4.1.0 | wordfence |
| WF-4186a609 | robokassa < 1.6.2 |
MEDIUM | 6.1 | The Robokassa payment gateway for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in ve… | 1.6.2 | wordfence |
| WF-417ff4fd | amp-plus | MEDIUM | 6.1 | The AMP+ Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including,… | — | wordfence |
| WF-417fb507 | admin-bookmarks | MEDIUM | 6.1 | The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject'… | — | wordfence |
| WF-416fc00d | login-with-ajax < 3.0.4.1 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin befo… | 3.0.4.1 | wordfence |
| WF-4148b37e | portfolio < 2.4.0 |
MEDIUM | 6.1 | The Portfolio by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘category’… | 2.4.0 | wordfence |
| WF-414013e9 | wpjobboard < 5.7.0 |
MEDIUM | 6.1 | … | 5.7.0 | wordfence |
| WF-41307a48 | sell-media < 2.4.2 |
MEDIUM | 6.1 | A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows… | 2.4.2 | wordfence |
| WF-41219c9d | yolink-search < 2.6 |
MEDIUM | 6.1 | The yolink Search for WordPress plugin for WordPress is vulnerable to Cross-Site Scripting via the 's' parameter in vers… | 2.6 | wordfence |
| WF-410cc5f0 | hot-linked-image-cacher | MEDIUM | 6.1 | The Hot Linked Image Cacher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an several paramete… | — | wordfence |
| WF-410ae0f1 | loginizer < 1.7.6 |
MEDIUM | 6.1 | The Loginizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘name’ parameter in versi… | 1.7.6 | wordfence |
| WF-40f79195 | give < 0.8.5 |
MEDIUM | 6.1 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Cross-Site Scripting in ve… | 0.8.5 | wordfence |
| WF-40ec1b62 | dt-reservation-plugin < 1.7 |
MEDIUM | 6.1 | The Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1… | 1.7 | wordfence |
| WF-40dc5db4 | leadboxer < 1.4 |
MEDIUM | 6.1 | The LeadBoxer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including,… | 1.4 | wordfence |
| WF-40c20b9d | woo-discount-rules < 2.4.2 |
MEDIUM | 6.1 | The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back i… | 2.4.2 | wordfence |
| WF-40c134ed | sticky-social-bar | MEDIUM | 6.1 | The Sticky Social Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ… | — | wordfence |
| WF-40b5d7e4 | 2-click-socialmedia-buttons < 0.34 |
MEDIUM | 6.1 | Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress… | 0.34 | wordfence |
| WF-409f3a27 | cart66-cloud | MEDIUM | 6.1 | The Cart66 Cloud plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, … | — | wordfence |
| WF-4096367c | keywords-highlight-tool | MEDIUM | 6.1 | The Search engine keywords highlighter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions … | — | wordfence |
| WF-408e14e7 | ab-google-map-travel | MEDIUM | 6.1 | The AB Google Map Travel (AB-MAP) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… | — | wordfence |
| WF-40766e17 | notify-odoo < 1.0.1 |
MEDIUM | 6.1 | The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… | 1.0.1 | wordfence |
| WF-406fe34a | wp-all-import < 3.4.6 |
MEDIUM | 6.1 | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to in… | 3.4.6 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →