Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 873 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-11dceac7 | jetpack < 13.4 |
MEDIUM | 6.4 | The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… | 13.4 | wordfence |
| WF-11dbc647 | wp-postratings < 1.91.2 |
MEDIUM | 6.4 | The WP-PostRatings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google rich text snippets in ve… | 1.91.2 | wordfence |
| WF-11d68c98 | wedocs < 2.3.1 |
MEDIUM | 6.4 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stor… | 2.3.1 | wordfence |
| WF-11d4c028 | flatsome < 3.19.0 |
MEDIUM | 6.4 | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Vid… | 3.19.0 | wordfence |
| WF-11d292fd | ultimate-addons-for-gutenberg < 2.20.5 |
MEDIUM | 6.4 | The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all version… | 2.20.5 | wordfence |
| WF-11ad51d9 | mycred < 2.9.4.4 |
MEDIUM | 6.4 | The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.4.3 d… | 2.9.4.4 | wordfence |
| WF-11aac185 | perfect-font-awesome-integration < 2.3.1 |
MEDIUM | 6.4 | The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's … | 2.3.1 | wordfence |
| WF-11a7e69d | inline-click-to-tweet | MEDIUM | 6.4 | The Inline Click To Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inclu… | — | wordfence |
| WF-1196b20e | td-composer < 5.4.5 |
MEDIUM | 6.4 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, … | 5.4.5 | wordfence |
| WF-11867941 | rehub-framework < 19.9.9.7 |
MEDIUM | 6.4 | The REHub Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and excluding, … | 19.9.9.7 | wordfence |
| WF-11807042 | fat-event-lite | MEDIUM | 6.4 | The FAT Event Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1… | — | wordfence |
| WF-116c57c2 | redux-framework < 4.5.14 |
MEDIUM | 6.4 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions … | 4.5.14 | wordfence |
| WF-11681152 | insert-php < 2.2.9 |
MEDIUM | 6.4 | The insert-php (aka Woody ad snippets) plugin before 2.2.9 for WordPress allows authenticated XSS via the winp_item para… | 2.2.9 | wordfence |
| WF-11542fc6 | mx-time-zone-clocks < 3.4.1 |
MEDIUM | 6.4 | The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_cl… | 3.4.1 | wordfence |
| WF-1144ed12 | wp-security-audit-log < 5.6.0 |
MEDIUM | 6.4 | The Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5… | 5.6.0 | wordfence |
| WF-1144e0d9 | auxin-elements < 2.17.14 |
MEDIUM | 6.4 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via … | 2.17.14 | wordfence |
| WF-11419311 | shortcodes-ultimate < 7.4.0 |
MEDIUM | 6.4 | The Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi… | 7.4.0 | wordfence |
| WF-113c154d | buddypress < 12.5.1 |
MEDIUM | 6.4 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in… | 12.5.1 | wordfence |
| WF-11386b6a | powerpack-lite-for-elementor < 2.7.19 |
MEDIUM | 6.4 | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Twe… | 2.7.19 | wordfence |
| WF-1137f15c | wpb-elementor-addons | MEDIUM | 6.4 | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includ… | — | wordfence |
| WF-111a0507 | appizy-app-embed < 2.4.0 |
MEDIUM | 6.4 | The App Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appizy' shortcode in a… | 2.4.0 | wordfence |
| WF-110a1b28 | smart-custom-fields < 5.0.8 |
MEDIUM | 6.4 | The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi… | 5.0.8 | wordfence |
| WF-1102b3ef | gs-projects < 1.1.2 |
MEDIUM | 6.4 | The Project Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,… | 1.1.2 | wordfence |
| WF-10fbb942 | bdthemes-prime-slider-lite < 4.7.0 |
MEDIUM | 6.4 | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerabl… | 4.7.0 | wordfence |
| WF-10f7688e | element-ready-lite < 6.4.4 |
MEDIUM | 6.4 | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up … | 6.4.4 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →