Parallax Scrolling Enllax.js
Parallax Scrolling Enllax.js has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
None of the 2 issues recorded for Parallax Scrolling Enllax.js have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Kévin Mosbahi (Mika). Parallax Scrolling Enllax.js is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.1.24.
CVE-2025-58830Parallax Scrolling Enllax.js <= 0.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Parallax Scrolling Enllax.js
Author
snagysandor
Parallax Scrolling Effect by Enllax.js An ultra-lightweight and super easy to use plugin for applying parallax scrolling effect to any scrolling element. You can set parallax scrolling effects to background elements, and also in both directions (vertically or horizontally) Demo Shortcode example With external image: [enllax xclass=”enllax” offset=”0″ direction=”horizontal” speed=”0.8″ img=”image url”] Your content. [enllaxend] With internal image (featured image and content): [enllax_post postid=”1″ xclass=”enllax” offset=”0″ direction=”horizontal” speed=”0.8″] xclass: CSS class name (default: enllax) offset: background offset in pixel (default: 0) direction: vertical (default) or horizontal speed: to allow background image to move with different speed, just use a data attribute with a numeric value as a multiplier for scrolling speed, less is slower and 1 is normal (default value: 0.5) img: Parallax background image url
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C