Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 915 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-f9259875 | fbpromotions | MEDIUM | 6.1 | Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotio… | — | wordfence |
| WF-f91838e7 | captcha < 4.3.0 |
MEDIUM | 6.1 | The Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘category’ parameter in ver… | 4.3.0 | wordfence |
| WF-f90f5f35 | give < 2.17.3 |
MEDIUM | 6.1 | The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back i… | 2.17.3 | wordfence |
| WF-f90a1ad8 | googledrive-folder-list | MEDIUM | 6.1 | The GoogleDrive folder list plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl… | — | wordfence |
| WF-f906ee78 | fv-descriptions < 1.5 |
MEDIUM | 6.1 | The FV Descriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includin… | 1.5 | wordfence |
| WF-f8f8e436 | peters-date-countdown < 2.0.1 |
MEDIUM | 6.1 | The Peter's Date Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_S… | 2.0.1 | wordfence |
| WF-f8f86293 | essential-addons-elementor < 5.4.9 |
MEDIUM | 6.1 | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions … | 5.4.9 | wordfence |
| WF-f8f1001e | import-from-yml < 4.0.0 |
MEDIUM | 6.1 | The Import from YML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and includin… | 4.0.0 | wordfence |
| WF-f8efd36a | affiliate-links < 3.2.0 |
MEDIUM | 6.1 | The Affiliate Links Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and inc… | 3.2.0 | wordfence |
| WF-f8e6beeb | super-forms < 6.0.4 |
MEDIUM | 6.1 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via th… | 6.0.4 | wordfence |
| WF-f8de9a0d | mediabay | MEDIUM | 6.1 | The Mediabay - WordPress Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in a… | — | wordfence |
| WF-f8db6a27 | tweet-wheel < 1.0.3.3 |
MEDIUM | 6.1 | The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_… | 1.0.3.3 | wordfence |
| WF-f8b69e14 | defa-online-image-protector | MEDIUM | 6.1 | The Defa Online Image Protector Free Edition plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via th… | — | wordfence |
| WF-f8b178ed | mymedi < 1.7.7 |
MEDIUM | 6.1 | The MyMedi theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to 1.7.7 due to insufficie… | 1.7.7 | wordfence |
| WF-f8a356db | social-connect < 0.10.2 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 0.10.1 and earlier for Wor… | 0.10.2 | wordfence |
| WF-f89373e8 | machform-shortcode < 1.5.0 |
MEDIUM | 6.1 | The MachForm Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… | 1.5.0 | wordfence |
| WF-f88eaf82 | parallelus-traject < 2.0 |
MEDIUM | 6.1 | The Parallelus Unite, Intersect, Traject, & Salutation Premium WordPress Themes for WordPress are vulnerable to Reflecte… | 2.0 | wordfence |
| WF-f88eaf82 | parallelus-salutation < 2.0 |
MEDIUM | 6.1 | The Parallelus Unite, Intersect, Traject, & Salutation Premium WordPress Themes for WordPress are vulnerable to Reflecte… | 2.0 | wordfence |
| WF-f88eaf82 | parallelus-unite < 2.0 |
MEDIUM | 6.1 | The Parallelus Unite, Intersect, Traject, & Salutation Premium WordPress Themes for WordPress are vulnerable to Reflecte… | 2.0 | wordfence |
| WF-f88eaf82 | parallelus-intersect < 2.0 |
MEDIUM | 6.1 | The Parallelus Unite, Intersect, Traject, & Salutation Premium WordPress Themes for WordPress are vulnerable to Reflecte… | 2.0 | wordfence |
| WF-f88da532 | lgpd-framework | MEDIUM | 6.1 | The LGPD Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including… | — | wordfence |
| WF-f88aa3de | pixfort-core < 3.2.26 |
MEDIUM | 6.1 | The pixfort Core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, … | 3.2.26 | wordfence |
| WF-f8534891 | webarx | MEDIUM | 6.1 | The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. | — | wordfence |
| WF-f849d0e8 | offset-writing | MEDIUM | 6.1 | The offset writing theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including,… | — | wordfence |
| WF-f83b36fe | soledad < 8.4.2 |
MEDIUM | 6.1 | The Soledad theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 8.4.1 … | 8.4.2 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →