Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Sports Club Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' attributes of the shortcode in all versions u…Check if you run itEPSS 0.32%Apr 8, 2026
- Medium6.4The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [print_clmns] shortcode in all ver…Check if you run itEPSS 0.41%Apr 8, 2026
- Medium6.4The Pinterest Site Verification plugin using Meta Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_var' parameter in versions up to,…Check if you run itEPSS 0.36%Apr 8, 2026
- Medium4.4The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ parameter in all versions up to…Check if you run itEPSS 0.24%Apr 8, 2026
- Medium5.4The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded SVG files in all versions up to, and including, 3.6.0 due to insuffi…Check if you run itEPSS 0.17%Apr 8, 2026
- Medium6.4The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scrip…Check if you run itEPSS 0.26%Apr 8, 2026
- Medium5.1Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier.Check if you run itEPSS 0.24%Apr 8, 2026
- Medium6.4The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' paramete…Check if you run itEPSS 0.35%Apr 8, 2026
- Medium6.4The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all v…Check if you run itEPSS 0.35%Apr 8, 2026
- Medium6.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode i…Check if you run itEPSS 0.35%Apr 8, 2026
- Medium6.4The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribute in al…Check if you run itEPSS 0.35%Apr 8, 2026
- Medium6.4The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up…Check if you run itEPSS 0.35%Apr 8, 2026
- Medium6.4The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and includ…Check if you run itEPSS 0.26%Apr 8, 2026
- Medium6.4The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attribute in the shortcode in all versions up to, and including, 2.3.4.Check if you run itEPSS 0.33%Apr 8, 2026
- Medium6.4The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and including…Check if you run itEPSS 0.26%Apr 8, 2026
- Medium6.1Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used.Check if you run itEPSS 0.29%Apr 8, 2026
- Medium4.7The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in the AJAX action in all versions up to, and including, 2.9.30.Check if you run itEPSS 0.39%Apr 8, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.38%Apr 8, 2026
- Medium5.4GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytic…Check if you run itEPSS 0.35%Apr 8, 2026
- Medium6.9Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross…Check if you run itEPSS 0.45%Apr 7, 2026
- Medium6.9Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension all…Check if you run itEPSS 0.45%Apr 7, 2026
- Medium6.9Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension al…Check if you run itEPSS 0.45%Apr 7, 2026
- Critical9.0SiYuan is a personal knowledge management system.Check if you run itEPSS 0.65%Apr 7, 2026
- Medium5.3Cronicle is a multi-server task scheduler and runner, with a web based front-end UI.Check if you run itEPSS 0.24%Apr 7, 2026
- Medium5.4Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.Check if you run itEPSS 0.24%Apr 7, 2026