Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1120 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-2f621cfa | themify-wc-product-filter < 1.4.4 |
MEDIUM | 6.1 | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all v… | 1.4.4 | wordfence |
| WF-2f5d874a | woocommerce-bulk-stock-management < 2.2.34 |
MEDIUM | 6.1 | The WooCommerce Bulk Stock Management plugin plugin for WordPress is vulnerable to Cross-Site Scripting in versions up t… | 2.2.34 | wordfence |
| WF-2f58d7e9 | post-connector | MEDIUM | 6.1 | The Post Connector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including… | — | wordfence |
| WF-2f4a0b8d | wassup < 1.8.3.1 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote a… | 1.8.3.1 | wordfence |
| WF-2f438626 | image-wall < 3.1 |
MEDIUM | 6.1 | The Image Wall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including… | 3.1 | wordfence |
| WF-2f40b4fb | wp-photo-album-plus < 9.2.07.002 |
MEDIUM | 6.1 | The Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includi… | 9.2.07.002 | wordfence |
| WF-2f383a56 | subaccounts-for-woocommerce < 1.6.1 |
MEDIUM | 6.1 | The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of a… | 1.6.1 | wordfence |
| WF-2f34854a | wp-forms-puzzle-captcha | MEDIUM | 6.1 | The WP Forms Puzzle Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl… | — | wordfence |
| WF-2f340cfe | kento-post-view-counter | MEDIUM | 6.1 | The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_… | — | wordfence |
| WF-2f280d50 | wp-gotowebinar < 15.8 |
MEDIUM | 6.1 | The WP GoToWebinar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… | 15.8 | wordfence |
| WF-2f257c92 | peters-random-anti-spam-image | MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in Peter's Random Anti-Spam Image 1.0.6 and earlier plugin for WordPress allows… | — | wordfence |
| WF-2f14b0b9 | woo-bulk-editor < 1.1.4.3 |
MEDIUM | 6.1 | The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulne… | 1.1.4.3 | wordfence |
| WF-2f0e7f9f | trustist-reviewer | MEDIUM | 6.1 | The TRUSTist REVIEWer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includ… | — | wordfence |
| WF-2f08961b | spostarbust < 1.2.04.25 |
MEDIUM | 6.1 | The EZ Related Posts Footer Links and Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver… | 1.2.04.25 | wordfence |
| WF-2efeffa2 | page-builder-by-azexo | MEDIUM | 6.1 | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ… | — | wordfence |
| WF-2ef6d5f4 | mobile-smart | MEDIUM | 6.1 | The Mobile Smart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, … | — | wordfence |
| WF-2ee837fd | theagency | MEDIUM | 6.1 | The TheAgency theme for WordPress is vulnerable to Cross-Site Scripting due to insufficient input sanitization and outpu… | — | wordfence |
| WF-2ee3d536 | digital-store < 1.3.3 |
MEDIUM | 6.1 | The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.… | 1.3.3 | wordfence |
| WF-2ec35484 | social-share-with-floating-bar | MEDIUM | 6.1 | The Social Share With Floating Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use o… | — | wordfence |
| WF-2eb70d40 | rognone | MEDIUM | 6.1 | The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up… | — | wordfence |
| WF-2eb65c25 | starred-review | MEDIUM | 6.1 | The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all… | — | wordfence |
| WF-2e9291e8 | woo-order-export-lite < 3.3.2 |
MEDIUM | 6.1 | … | 3.3.2 | wordfence |
| WF-2e8abe63 | improved-user-search-in-backend < 1.2.6 |
MEDIUM | 6.1 | Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved us… | 1.2.6 | wordfence |
| WF-2e895698 | master-bar | MEDIUM | 6.1 | The Master Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.… | — | wordfence |
| WF-2e8527c0 | store-credit-for-woocommerce < 1.0.49.47 |
MEDIUM | 6.1 | The Store credit / Gift cards for woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via t… | 1.0.49.47 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →