Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,645 vulnerabilities found (page 970 of 1866)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-c5e66244 | taxonomy-terms-order < 1.4.6.1 |
MEDIUM | 6.1 | The Category Order and Taxonomy Terms Order plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to… | 1.4.6.1 | wordfence |
| WF-c5e011d3 | advanced-text-widget < 2.0.2 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress a… | 2.0.2 | wordfence |
| WF-c5d8a452 | stop-registration-spam | MEDIUM | 6.1 | The Stop Registration Spam plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and i… | — | wordfence |
| WF-c5d17538 | football-pool < 2.13.5 |
MEDIUM | 6.1 | The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST paramete… | 2.13.5 | wordfence |
| WF-c5c96063 | woocommerce-social-media-share-buttons | MEDIUM | 6.1 | The Woocommerce Social Media Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi… | — | wordfence |
| WF-c5bf1c8c | soundslides < 2.5.0 |
MEDIUM | 6.1 | The Soundslides plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2… | 2.5.0 | wordfence |
| WF-c5b9e53e | system-dashboard < 2.8.10 |
MEDIUM | 6.1 | The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'X-Forwarded-For' head… | 2.8.10 | wordfence |
| WF-c5ab6a1f | google-picasa-albums-viewer < 4.0.3 |
MEDIUM | 6.1 | The Google Photos Gallery with Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all ve… | 4.0.3 | wordfence |
| WF-c5ab685c | photocrati-theme < 4.8.1 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress all… | 4.8.1 | wordfence |
| WF-c5aa0006 | wd-instagram-feed < 1.4.29 |
MEDIUM | 6.1 | The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulner… | 1.4.29 | wordfence |
| WF-c5a26a49 | funnel-builder < 3.15.0.6 |
MEDIUM | 6.1 | The FunnelKit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.1… | 3.15.0.6 | wordfence |
| WF-c5a263d5 | dc-woocommerce-multi-vendor < 4.2.0 |
MEDIUM | 6.1 | The WC Marketplace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including… | 4.2.0 | wordfence |
| WF-c5820352 | powerpress < 6.0.1 |
MEDIUM | 6.1 | Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows r… | 6.0.1 | wordfence |
| WF-c565f455 | affiliate-disclosure-statement | MEDIUM | 6.1 | The Affiliate Disclosure Statement plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t… | — | wordfence |
| WF-c55e1d38 | commentator < 2.5.3 |
MEDIUM | 6.1 | The Commentator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘provider’ parameter in… | 2.5.3 | wordfence |
| WF-c55487f9 | exchange-addon-easy-us-sales-taxes < 1.1.0 |
MEDIUM | 6.1 | Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_… | 1.1.0 | wordfence |
| WF-c5372890 | newsletter-optin-box < 1.6.5 |
MEDIUM | 6.1 | The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the … | 1.6.5 | wordfence |
| WF-c509345b | faq-builder-ays < 1.7.2 |
MEDIUM | 6.1 | The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ays_faq_tab' parameter… | 1.7.2 | wordfence |
| WF-c508d38c | helloprint < 1.4.7 |
MEDIUM | 6.1 | The Helloprint plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'success' parameter in versi… | 1.4.7 | wordfence |
| WF-c4ece408 | gyan-elements < 2.2.2 |
MEDIUM | 6.1 | The Gyan Elements plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including,… | 2.2.2 | wordfence |
| WF-c4debc89 | image-source-control-isc < 2.28.1 |
MEDIUM | 6.1 | The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-… | 2.28.1 | wordfence |
| WF-c4d86204 | booster-elite-for-woocommerce < 6.0.0 |
MEDIUM | 6.1 | The Booster plugins (Booster, Booster Plus, and Booster Elite) for WordPress are vulnerable to Reflected Cross-Site Scri… | 6.0.0 | wordfence |
| WF-c4d86204 | woocommerce-jetpack < 5.6.3 |
MEDIUM | 6.1 | The Booster plugins (Booster, Booster Plus, and Booster Elite) for WordPress are vulnerable to Reflected Cross-Site Scri… | 5.6.3 | wordfence |
| WF-c4d86204 | booster-plus-for-woocommerce < 6.0.0 |
MEDIUM | 6.1 | The Booster plugins (Booster, Booster Plus, and Booster Elite) for WordPress are vulnerable to Reflected Cross-Site Scri… | 6.0.0 | wordfence |
| WF-c4d19f85 | wp-all-import < 3.4.7 |
MEDIUM | 6.1 | The wp-all-import plugin before 3.4.7 for WordPress has XSS. | 3.4.7 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →