Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1176 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-e98ed932 | simple-tags < 3.6.5 |
MEDIUM | 5.5 | The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in v… | 3.6.5 | wordfence |
| WF-e96e94f8 | advanced-access-manager < 6.9.21 |
MEDIUM | 5.5 | The Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More plugin for WordPress is vu… | 6.9.21 | wordfence |
| WF-e9222c74 | vdz-google-analytics < 1.4.9 |
MEDIUM | 5.5 | The VDZ Google Analytics or Google Tag Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sev… | 1.4.9 | wordfence |
| WF-e91e6101 | newsletter < 6.5.4 |
MEDIUM | 5.5 | The Newsletter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.5.3 by the use of… | 6.5.4 | wordfence |
| WF-e9012824 | wordpress-popular-posts < 5.3.4 |
MEDIUM | 5.5 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3).… | 5.3.4 | wordfence |
| WF-e8d1c4ab | wp-postratings < 1.86.1 |
MEDIUM | 5.5 | The WP-PostRatings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postratings_image’ par… | 1.86.1 | wordfence |
| WF-e8ac3187 | duplicate-wp-page-post < 2.8 |
MEDIUM | 5.5 | The Duplicate Page and Post plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and inc… | 2.8 | wordfence |
| WF-e8a6e9b7 | slide-anything < 2.3.44 |
MEDIUM | 5.5 | The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow h… | 2.3.44 | wordfence |
| WF-e87ea6b5 | animated-number-counters < 1.7 |
MEDIUM | 5.5 | The Animated Number Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and in… | 1.7 | wordfence |
| WF-e86ab1ea | floating-social-media-icon | MEDIUM | 5.5 | The Social Media Flying Icons | Floating Social Media Icon plugin for WordPress is vulnerable to Stored Cross-Site Scrip… | — | wordfence |
| WF-e85df0dc | colorlib-coming-soon-maintenance < 1.0.99 |
MEDIUM | 5.5 | The plugin Coming Soon & Maintenance Mode by Colorlib for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 1.0.99 | wordfence |
| WF-e8270ef0 | content-staging | MEDIUM | 5.5 | The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation a… | — | wordfence |
| WF-e758b973 | backup-and-restore-for-wp | MEDIUM | 5.5 | The Backup and Restore plugin – WordPress plugin for WordPress is vulnerable to Arbitrary File Deletion via the 'folde… | — | wordfence |
| WF-e7535b43 | anthologize < 0.8.1 |
MEDIUM | 5.5 | The Anthologize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_title’, 'post_status… | 0.8.1 | wordfence |
| WF-e72e35de | hal < 2.2 |
MEDIUM | 5.5 | The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitizat… | 2.2 | wordfence |
| WF-e72b7e6b | shortpixel-adaptive-images < 3.8.4 |
MEDIUM | 5.5 | The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Server-Side… | 3.8.4 | wordfence |
| WF-e724394d | elementskit-lite < 3.0.4 |
MEDIUM | 5.5 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar … | 3.0.4 | wordfence |
| WF-e67422cc | wp-ticket < 5.10.4 |
MEDIUM | 5.5 | The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fi… | 5.10.4 | wordfence |
| WF-e659cc27 | qe-seo-handyman | MEDIUM | 5.5 | The Qe SEO Handyman plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0 due to ins… | — | wordfence |
| WF-e6001516 | kwayy-html-sitemap < 4.0 |
MEDIUM | 5.5 | The Kwayy HTML Sitemap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parame… | 4.0 | wordfence |
| WF-e57631c2 | responsive-coming-soon-page < 1.1.19 |
MEDIUM | 5.5 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admi… | 1.1.19 | wordfence |
| WF-e5726719 | seo-help | MEDIUM | 5.5 | The AI Content Writer, Autoblogging, Youtube Subtitle to Article – SEO Help plugin for WordPress is vulnerable to Serv… | — | wordfence |
| WF-e570a66a | apptivo-business-site < 3.0.14 |
MEDIUM | 5.5 | The Apptivo Business Site CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter… | 3.0.14 | wordfence |
| WF-e511497d | login-redirect | MEDIUM | 5.5 | The Login Redirect plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1… | — | wordfence |
| WF-e4b8947a | responsive-coming-soon-page < 1.1.19 |
MEDIUM | 5.5 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admi… | 1.1.19 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →