Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3SiYuan is an open-source personal knowledge management system.Check if you run itEPSS 0.38%Apr 17, 2026
- High8.7Note Mark is an open-source note-taking application.Check if you run itEPSS 0.42%Apr 17, 2026
- High7.2The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4.Patch nowKEVEPSS 0.42%Apr 17, 2026
- Critical9.0SiYuan is an open-source personal knowledge management system.Check if you run itEPSS 0.53%Apr 16, 2026
- Medium6.4The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in all v…Check if you run itEPSS 0.32%Apr 16, 2026
- Medium5.4The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded image title in versions up to, and…Check if you run itEPSS 0.24%Apr 16, 2026
- Medium6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.Check if you run itEPSS 0.23%Apr 16, 2026
- Medium5.4The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding.Check if you run itEPSS 0.19%Apr 16, 2026
- Medium6.1The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.Check if you run itEPSS 0.24%Apr 16, 2026
- Medium4.4The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0.Check if you run itEPSS 0.39%Apr 16, 2026
- High7.2The Prismatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prismatic_encoded' pseudo-shortcode in all versions up to, and including, 3.7.3.Check if you run itEPSS 0.32%Apr 16, 2026
- Medium6.4The BetterDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'betterdocs_feedback_form' shortcode in all versions up to, and including, 4.3.8.Check if you run itEPSS 0.26%Apr 16, 2026
- Medium6.1cusrev customer_reviews_for_woocommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.29%Apr 16, 2026
- Medium6.4The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting via plugin settings in all ve…Check if you run itEPSS 0.32%Apr 16, 2026
- Medium6.4The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put…Check if you run itEPSS 0.27%Apr 16, 2026
- Medium4.4The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0.Check if you run itEPSS 0.41%Apr 16, 2026
- Medium6.4The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery block text content in versions up to, and including, 1.20.32 due to insufficie…Check if you run itEPSS 0.26%Apr 16, 2026
- Medium6.1The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comment shortcode in versions up to, and including,…Check if you run itEPSS 0.29%Apr 16, 2026
- Medium6.4The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdocs_options[icon_size]' parameter in all versions up to, and including, 2.2.9…Check if you run itEPSS 0.26%Apr 16, 2026
- Medium6.4The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up…Check if you run itEPSS 0.32%Apr 16, 2026
- Medium6.4The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up to, and including, 1.7.29 du…Check if you run itEPSS 0.26%Apr 16, 2026
- Medium5.3Prometheus is an open-source monitoring system and time series database.Check if you run itEPSS 0.26%Apr 15, 2026
- Medium4.8Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component.Check if you run itEPSS 0.19%Apr 15, 2026
- Medium6.1ApostropheCMS is an open-source Node.js content management system.Check if you run itEPSS 0.28%Apr 15, 2026
- High8.7ApostropheCMS is an open-source Node.js content management system.Check if you run itEPSS 0.44%Apr 15, 2026