CVE-2019-9669: Wordfence

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities)

Affected products

• Wordfence Wordfence: version 7.2.3 only

Published 2019-04-25. Last modified 2026-06-17.