Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1178 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-da4f5af6 | analytics-for-wp | MEDIUM | 5.5 | The Analytics for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in vers… | — | wordfence |
| WF-da15614b | click-to-top < 1.2.8 |
MEDIUM | 5.5 | The click-to-top plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Type scroll text' field in v… | 1.2.8 | wordfence |
| WF-d99d7a26 | responsive-lightbox < 2.4.2 |
MEDIUM | 5.5 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sanitize_… | 2.4.2 | wordfence |
| WF-d979f899 | youtube-channel < 3.23.0 |
MEDIUM | 5.5 | The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in … | 3.23.0 | wordfence |
| WF-d95d8ca6 | tabs-responsive < 2.2.8 |
MEDIUM | 5.5 | The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged … | 2.2.8 | wordfence |
| WF-d8c0cd48 | traderunner < 3.10 |
MEDIUM | 5.5 | The Trade Runner plugin for WordPress is vulnerable to authenticated Stored Cross-Site Scripting in versions up to, and… | 3.10 | wordfence |
| WF-d8b47395 | poll-wp < 2.6.0 |
MEDIUM | 5.5 | The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to Server-Side Request Fo… | 2.6.0 | wordfence |
| WF-d7bf5f3c | simple-slider-ssp | MEDIUM | 5.5 | Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5. | — | wordfence |
| WF-d7778de0 | mihdan-no-external-links < 4.8.0 |
MEDIUM | 5.5 | The Mihdan: No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters i… | 4.8.0 | wordfence |
| WF-d73fd485 | thank-me-later | MEDIUM | 5.5 | The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputti… | — | wordfence |
| WF-d63bc735 | super-testimonial < 2.7 |
MEDIUM | 5.5 | The Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6… | 2.7 | wordfence |
| WF-d5df75f8 | under-construction-page < 3.86 |
MEDIUM | 5.5 | The Under Construction plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.85… | 3.86 | wordfence |
| WF-d5a124b3 | wp-olivecart | MEDIUM | 5.5 | The WP-OliveCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1… | — | wordfence |
| WF-d592b81d | minimal-coming-soon-maintenance-mode < 2.35 |
MEDIUM | 5.5 | The Minimal Coming Soon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_css’ and '… | 2.35 | wordfence |
| WF-d5744ed4 | fsflex-local-fonts | MEDIUM | 5.5 | The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could… | — | wordfence |
| WF-d542c1e8 | wp-media-library-categories < 2.0.0 |
MEDIUM | 5.5 | The Media Library Categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmediacategor… | 2.0.0 | wordfence |
| WF-d4b4b5a0 | webling < 3.9.1 |
MEDIUM | 5.5 | The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.9.0 du… | 3.9.1 | wordfence |
| WF-d44f8891 | sirv < 6.8.1 |
MEDIUM | 5.5 | The Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘SIRV_ACCOUNT_EMAIL’ parameter in… | 6.8.1 | wordfence |
| WF-d3b954e6 | gallery-images < 2.0.6 |
MEDIUM | 5.5 | The Image Gallery - Responsive Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the r… | 2.0.6 | wordfence |
| WF-d3a9a836 | seo-301-meta | MEDIUM | 5.5 | The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high priv… | — | wordfence |
| WF-d2a77443 | tinymce-custom-styles < 1.1.4 |
MEDIUM | 5.5 | The TinyMCE Custom Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versio… | 1.1.4 | wordfence |
| WF-d24b34d9 | wp-bannerize-pro < 1.11.0 |
MEDIUM | 5.5 | The WP Bannerize Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ… | 1.11.0 | wordfence |
| WF-d1d9166d | weather-layer | MEDIUM | 5.5 | The Weather Layer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.… | — | wordfence |
| WF-d1b4841b | highlight-focus | MEDIUM | 5.5 | The Highlight Focus plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, … | — | wordfence |
| WF-d0e2ae5c | nktagcloud | MEDIUM | 5.5 | The Better Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several setting parameters in… | — | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →