Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3.Check if you run itEPSS 0.35%Mar 21, 2026
- Medium6.4The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to, and in…Check if you run itEPSS 0.33%Mar 21, 2026
- Medium4.4The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all versions up to, and including, 1.1.5.Check if you run itEPSS 0.30%Mar 21, 2026
- Medium4.4The Comment SPAM Wiper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' setting in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.30%Mar 21, 2026
- Medium5.5The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the parameter in all versions up to, and including, 1.2 due t…Check if you run itEPSS 0.36%Mar 21, 2026
- Medium6.4The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all versions up to, and including,…Check if you run itEPSS 0.32%Mar 21, 2026
- High7.2The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parameter in all versions up to, and including, 0.3 d…Check if you run itEPSS 0.39%Mar 21, 2026
- Medium4.4The Ricerca – advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The Ed's Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.0.Check if you run itEPSS 0.19%Mar 21, 2026
- Medium6.4The Ed's Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.0.Check if you run itEPSS 0.24%Mar 21, 2026
- High7.2The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.3 via survey result submissions.Check if you run itEPSS 0.28%Mar 21, 2026
- Medium6.1The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1…Check if you run itEPSS 0.26%Mar 21, 2026
- Medium4.4The Reward Video Ad for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.1The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versi…Check if you run itEPSS 0.27%Mar 21, 2026
- Medium4.4The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8.1.Check if you run itEPSS 0.20%Mar 21, 2026
- Medium6.4The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusedesk_newcase shortcode in all versions up to, and including, 6.8 du…Check if you run itEPSS 0.19%Mar 21, 2026
- Medium6.4The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all versions up…Check if you run itEPSS 0.19%Mar 21, 2026
- Medium6.4The Integration with Hubspot Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hubspotform' shortcode in all versions up to, and includi…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The Any Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aps_slider shortcode in all versions up to, and including, 1.0.4…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The Simple Football Scoreboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ytmr_fb_scoreboard' shortcode in all versions up to, and incl…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The Outgrow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the 'outgrow' shortcode in all versions up to, and including, 2.1.Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all ver…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to i…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all versions up to, and including, 3.0…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.4The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ng-weather' shortcode in all versions up to, and including, 1.0.9…Check if you run itEPSS 0.24%Mar 21, 2026