Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,655 vulnerabilities found (page 1185 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-9ec83425 | woo-tipdonation | MEDIUM | 5.5 | The Woocommerce Tip/Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings i… | — | wordfence |
| WF-9eb829f2 | responsive-coming-soon-page < 1.1.19 |
MEDIUM | 5.5 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admi… | 1.1.19 | wordfence |
| WF-9e9fcaf5 | svg-support < 2.3.20 |
MEDIUM | 5.5 | The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in… | 2.3.20 | wordfence |
| WF-9e6434fb | poll-maker < 5.4.7 |
MEDIUM | 5.5 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Sc… | 5.4.7 | wordfence |
| WF-9e2214d8 | responsive-add-ons < 2.6.9 |
MEDIUM | 5.5 | The Responsive Starter Templates – Elementor & WordPress Templates plugin for WordPress is vulnerable to stored cross-… | 2.6.9 | wordfence |
| WF-9e1ae8f2 | table-of-contents-plus < 2411.1 |
MEDIUM | 5.5 | The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all v… | 2411.1 | wordfence |
| WF-9d879fc6 | wp-custom-taxonomy-meta | MEDIUM | 5.5 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_met… | — | wordfence |
| WF-9d5ed6cf | assistant < 1.4.4 |
MEDIUM | 5.5 | The Assistant plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.4.3 … | 1.4.4 | wordfence |
| WF-9d389098 | paytium < 4.3.7 |
MEDIUM | 5.5 | The Paytium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paytium_live_api_key' option and … | 4.3.7 | wordfence |
| WF-9d1fcdb9 | advanced-ads < 1.32.0 |
MEDIUM | 5.5 | The Advanced Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title parameter in versions u… | 1.32.0 | wordfence |
| WF-9c3dc5fe | mailchimp-for-wp < 4.8.7 |
MEDIUM | 5.5 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several paramet… | 4.8.7 | wordfence |
| WF-9bbcd280 | hotjar-connecticator | MEDIUM | 5.5 | The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotja… | — | wordfence |
| WF-9b8042b0 | resmushit-image-optimizer < 0.4.6 |
MEDIUM | 5.5 | The reSmush.it plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in … | 0.4.6 | wordfence |
| WF-9b0cc3a0 | slideshow-ck < 1.4.10 |
MEDIUM | 5.5 | The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow hig… | 1.4.10 | wordfence |
| WF-9ae9b5c7 | testimonial-builder < 1.6.0 |
MEDIUM | 5.5 | The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege u… | 1.6.0 | wordfence |
| WF-9acf80aa | post-expirator < 4.10.1 |
MEDIUM | 5.5 | The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 4.10.1 | wordfence |
| WF-9a7f738e | ml-slider < 3.27.9 |
MEDIUM | 5.5 | The "Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Plugin" plugin for WordPress is vulnerable to … | 3.27.9 | wordfence |
| WF-9a4488c8 | events-made-easy < 2.2.24 |
MEDIUM | 5.5 | The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privi… | 2.2.24 | wordfence |
| WF-99e61ed1 | quick-paypal-payments < 5.7.26 |
MEDIUM | 5.5 | The Quick Paypal Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings through s… | 5.7.26 | wordfence |
| WF-999cf54e | read-and-understood < 2.2 |
MEDIUM | 5.5 | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general… | 2.2 | wordfence |
| WF-9985627d | notibar < 2.1.6 |
MEDIUM | 5.5 | The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adm… | 2.1.6 | wordfence |
| WF-994a044d | photo-gallery < 1.8.22 |
MEDIUM | 5.5 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scr… | 1.8.22 | wordfence |
| WF-993f6505 | imageboss < 3.0.6 |
MEDIUM | 5.5 | The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high… | 3.0.6 | wordfence |
| WF-990b3318 | meks-easy-social-share < 1.2.8 |
MEDIUM | 5.5 | The Meks Easy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its paramete… | 1.2.8 | wordfence |
| WF-98c2d04d | analytics-cat < 1.1.0 |
MEDIUM | 5.5 | The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t… | 1.1.0 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →