Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,661 vulnerabilities found (page 1487 of 1867)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-da2dd641 | js-support-ticket < 2.8.8 |
MEDIUM | 4.4 | The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting i… | 2.8.8 | wordfence |
| WF-da11abe7 | whats-new-genarator | MEDIUM | 4.4 | The What's New Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ver… | — | wordfence |
| WF-d9e0b180 | dropshipping-xox | MEDIUM | 4.4 | The Dropshix plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.14 … | — | wordfence |
| WF-d9c97745 | dts-simple-share | MEDIUM | 4.4 | The Simple Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… | — | wordfence |
| WF-d9a2ee71 | ws-contact-form < 1.3.8 |
MEDIUM | 4.4 | The WS Contact Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, … | 1.3.8 | wordfence |
| WF-d989b1ee | wp-tesseract | MEDIUM | 4.4 | The WP Tesseract plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0… | — | wordfence |
| WF-d97ba75a | remove-footer-credit < 1.0.14 |
MEDIUM | 4.4 | The Remove Footer Credit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ver… | 1.0.14 | wordfence |
| WF-d961f6ed | pipdisqus < 1.7 |
MEDIUM | 4.4 | The pipDisqus plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6 du… | 1.7 | wordfence |
| WF-d926d9fd | pretty-simple-popup-builder < 1.0.10 |
MEDIUM | 4.4 | The Pretty Simple Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and… | 1.0.10 | wordfence |
| WF-d9009880 | bit-form < 3.1.4 |
MEDIUM | 4.4 | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is… | 3.1.4 | wordfence |
| WF-d8fbfcfe | pods < 3.2.8.1 |
MEDIUM | 4.4 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin… | 3.2.8.1 | wordfence |
| WF-d8e967ce | custom-field-suite < 2.6.5 |
MEDIUM | 4.4 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versio… | 2.6.5 | wordfence |
| WF-d8c19868 | simplemodal-contact-form-smcf | MEDIUM | 4.4 | The SimpleModal Contact Form (SMCF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings… | — | wordfence |
| WF-d8b5b320 | time-clock < 1.3 |
MEDIUM | 4.4 | The Time Clock plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.3… | 1.3 | wordfence |
| WF-d88eb628 | continuous-announcement-scroller | MEDIUM | 4.4 | The Continuous announcement scroller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin se… | — | wordfence |
| WF-d862e8e6 | new-adman | MEDIUM | 4.4 | The New Adman plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, an… | — | wordfence |
| WF-d851760a | recurring-donation < 1.9 |
MEDIUM | 4.4 | The Recurring PayPal Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and … | 1.9 | wordfence |
| WF-d7b67c83 | evergreen-content-poster < 1.4.1 |
MEDIUM | 4.4 | The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulner… | 1.4.1 | wordfence |
| WF-d769dd4f | easy-elements-hider | MEDIUM | 4.4 | The Easy Elements Hider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi… | — | wordfence |
| WF-d7526228 | wikilookup | MEDIUM | 4.4 | The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all ve… | — | wordfence |
| WF-d74f5813 | order-delivery-date | MEDIUM | 4.4 | The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin se… | — | wordfence |
| WF-d749db62 | letterpress < 2.4.0 |
MEDIUM | 4.4 | The LetterPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, … | 2.4.0 | wordfence |
| WF-d732ea2d | wesecur-security | MEDIUM | 4.4 | The WeSecur Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up… | — | wordfence |
| WF-d713ff91 | form-maker < 1.15.25 |
MEDIUM | 4.4 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Store… | 1.15.25 | wordfence |
| WF-d7051345 | wp-carousel-free < 2.6.9 |
MEDIUM | 4.4 | The Carousel, Slider, Gallery by WP Carousel – Image Carousel with Lightbox & Photo Gallery, Video Slider, Post Carous… | 2.6.9 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →