Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1154 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-0ebc4c47 | favicon-by-realfavicongenerator < 1.3.23 |
MEDIUM | 6.1 | The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result… | 1.3.23 | wordfence |
| WF-0e8f63e3 | igniteup < 3.4.1 |
MEDIUM | 6.1 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. | 3.4.1 | wordfence |
| WF-0e7b694f | cforms < 10.5 |
MEDIUM | 6.1 | The cforms2 plugin before 10.5 for WordPress has XSS. | 10.5 | wordfence |
| WF-0e7af92f | wp-app-bar | MEDIUM | 6.1 | The App Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.5 d… | — | wordfence |
| WF-0e7825de | better-protected-pages | MEDIUM | 6.1 | The Better Protected Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i… | — | wordfence |
| WF-0e5c11dc | uncomplicated-seo | MEDIUM | 6.1 | The Uncomplicated SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and in… | — | wordfence |
| WF-0e549e4c | woo-ukrposhta < 1.18.0 |
MEDIUM | 6.1 | The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd… | 1.18.0 | wordfence |
| WF-0e50b6a0 | your-lightbox | MEDIUM | 6.1 | The Your Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including,… | — | wordfence |
| WF-0e4f6305 | bulk-noindex-nofollow-toolkit-by-mad-fish < 1.5 |
MEDIUM | 6.1 | The Bulk NoIndex & NoFollow Toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' par… | 1.5 | wordfence |
| WF-0e4c0500 | ultimate-tinymce < 3.6 |
MEDIUM | 6.1 | The Ultimate TinyMCE plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 3.6 due to insufficie… | 3.6 | wordfence |
| WF-0e47daed | product-delivery-date-for-woocommerce-lite < 2.8.1 |
MEDIUM | 6.1 | The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting … | 2.8.1 | wordfence |
| WF-0e452c66 | smart-product-gallery-slider | MEDIUM | 6.1 | The Smart Product Gallery Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,… | — | wordfence |
| WF-0e3adbc2 | wpcomplete < 2.9.5 |
MEDIUM | 6.1 | The WPComplete plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in versi… | 2.9.5 | wordfence |
| WF-0e2e6a72 | elessi-theme < 6.4.1 |
MEDIUM | 6.1 | The Elessi theme for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 6.3… | 6.4.1 | wordfence |
| WF-0e27b0a8 | bsk-contact-form-7-blacklist | MEDIUM | 6.1 | The BSK Contact Form 7 Blacklist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inserted_… | — | wordfence |
| WF-0e230f9f | archivist-custom-archive-templates < 1.7.6 |
MEDIUM | 6.1 | The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the … | 1.7.6 | wordfence |
| WF-0e227024 | global-payments-woocommerce < 1.13.3 |
MEDIUM | 6.1 | The GlobalPayments WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, a… | 1.13.3 | wordfence |
| WF-0e0bee7c | user-registration < 4.1.0 |
MEDIUM | 6.1 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vu… | 4.1.0 | wordfence |
| WF-0e0332d1 | wp-customer-reviews < 3.8.0 |
MEDIUM | 6.1 | The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' param… | 3.8.0 | wordfence |
| WF-0e030ff8 | bulk-youtube-post-creator | MEDIUM | 6.1 | The Bulk YouTube Post Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, an… | — | wordfence |
| WF-0df6f15f | cleantalk-spam-protect < 5.174.1 |
MEDIUM | 6.1 | The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQ… | 5.174.1 | wordfence |
| WF-0df57ee1 | product-quantity-for-woocommerce < 5.2.3 |
MEDIUM | 6.1 | The Min Max Step Quantity Limits Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scri… | 5.2.3 | wordfence |
| WF-0de79672 | calculatorpro-calculators | MEDIUM | 6.1 | The CalculatorPro Calculators plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple paramete… | — | wordfence |
| WF-0ddc7488 | silverorchid | MEDIUM | 6.1 | The silverOrchid theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in versio… | — | wordfence |
| WF-0dd2705e | url-cloak-encrypt < 3.8.0 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin < 3.8.0 for Wor… | 3.8.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →