Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1114 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-3537ea8b | auto-repair | MEDIUM | 6.1 | The Auto Repair theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 22… | — | wordfence |
| WF-35293a82 | jetpack < 4.2 |
MEDIUM | 6.1 | The Jetpack plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the add_query_args() function in ve… | 4.2 | wordfence |
| WF-351c7d18 | smart-marketing-for-wp < 2.0.0 |
MEDIUM | 6.1 | The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/cus… | 2.0.0 | wordfence |
| WF-3511f952 | ts-comfort-database | MEDIUM | 6.1 | The TS Comfort DB plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and includ… | — | wordfence |
| WF-34f7ab72 | woo-edit-templates < 1.1.2 |
MEDIUM | 6.1 | The Edit WooCommerce Templates plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and includi… | 1.1.2 | wordfence |
| WF-34f260bd | wp-asambleas | MEDIUM | 6.1 | The WP-Asambleas plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and includi… | — | wordfence |
| WF-34e62362 | post-sync | MEDIUM | 6.1 | The Post Sync plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including,… | — | wordfence |
| WF-34e3ef09 | popup-images | MEDIUM | 6.1 | The Popup Images plugin for WordPress is vulnerable to Cross-Site Scripting due to insufficient input sanitization and o… | — | wordfence |
| WF-34d01610 | woocommerce-predictive-search < 6.1.0 |
MEDIUM | 6.1 | The WooCommerce Predictive Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to… | 6.1.0 | wordfence |
| WF-34bae29d | appointment-calendar < 2.7.5 |
MEDIUM | 6.1 | The Appointment Calendar plugin for WordPress is vulnerable to Multiple Reflected Cross-Site Scripting via several param… | 2.7.5 | wordfence |
| WF-34ac0d3f | js-paper | MEDIUM | 6.1 | The Js paper theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.5.7… | — | wordfence |
| WF-34a46c3a | edd-recount-earnings < 2.3.7 |
MEDIUM | 6.1 | The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x be… | 2.3.7 | wordfence |
| WF-34a38049 | real-estate-listing-realtyna-wpl < 5.4.2 |
MEDIUM | 6.1 | The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting i… | 5.4.2 | wordfence |
| WF-349e3b4a | bello < 1.6.0 |
MEDIUM | 6.1 | The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view,… | 1.6.0 | wordfence |
| WF-349abf0b | simple-stripe-checkout | MEDIUM | 6.1 | The Simple Stripe Checkout plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and i… | — | wordfence |
| WF-3497974d | custom-css < 2.4.0 |
MEDIUM | 6.1 | The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer… | 2.4.0 | wordfence |
| WF-347573cf | doofinder | MEDIUM | 6.1 | The Doofinder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 0.5… | — | wordfence |
| WF-347307eb | wp-e-commerce-style-email | MEDIUM | 6.1 | The WP e-Commerce Style Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, an… | — | wordfence |
| WF-34728e7a | bird-feeder | MEDIUM | 6.1 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote at… | — | wordfence |
| WF-346d9473 | wp-projects-portfolio | MEDIUM | 6.1 | The WP Projects Portfolio with Client Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in a… | — | wordfence |
| WF-346cc9af | paramount | MEDIUM | 6.1 | The Paramount theme for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versio… | — | wordfence |
| WF-3462a1b7 | woosidebars-sbm-converter < 1.1.2 |
MEDIUM | 6.1 | The WooSidebars Sidebar Manager Converter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL… | 1.1.2 | wordfence |
| WF-3447c0ff | font-organizer | MEDIUM | 6.1 | The Font Organizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'manage_font_id' parameter i… | — | wordfence |
| WF-343f5ad1 | news-list | MEDIUM | 6.1 | The NewsTicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'news_ticker_id' parameter i… | — | wordfence |
| WF-343ef232 | risk-warning-bar | MEDIUM | 6.1 | The Risk Warning Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includi… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →