Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3Movable Type provided by Six Apart Ltd.Check if you run itEPSS 0.67%Apr 8, 2026
- Medium6.9Movable Type provided by Six Apart Ltd.Check if you run itEPSS 0.36%Apr 8, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCheck if you run itEPSS 0.14%Apr 8, 2026
- Medium5.3Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This iCheck if you run itEPSS 0.20%Apr 8, 2026
- Medium5.3Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.Check if you run itEPSS 0.24%Apr 8, 2026
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSCheck if you run itEPSS 0.18%Apr 8, 2026
- Medium5.3Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels.Check if you run itEPSS 0.20%Apr 8, 2026
- Medium6.4The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versions up to, and includiCheck if you run itEPSS 0.24%Apr 8, 2026
- Medium4.3The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8Check if you run itEPSS 0.56%Apr 8, 2026
- Medium5.3The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7.Check if you run itEPSS 0.34%Apr 8, 2026
- Medium6.4The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and including 8.4.2.Check if you run itEPSS 0.40%Apr 8, 2026
- High7.0An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers.Check if you run itEPSS 0.31%Apr 8, 2026
- High7.5The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending postsCheck if you run itEPSS 0.36%Apr 8, 2026
- Medium5.4The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2.Check if you run itEPSS 0.19%Apr 8, 2026
- Medium5.4The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded SVG files in all versions up to, and including, 3.6.0 due to insufficient input sCheck if you run itEPSS 0.18%Apr 8, 2026
- Medium6.4The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 0.2.6.Check if you run itEPSS 0.19%Apr 8, 2026
- Medium4.3The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.Check if you run itEPSS 0.17%Apr 8, 2026
- Medium4.4The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ parameter in all versions up to, and includiCheck if you run itEPSS 0.20%Apr 8, 2026
- Medium5.3The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to anCheck if you run itEPSS 0.39%Apr 8, 2026
- Medium6.4The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [print_clmns] shortcode in all versions up to aCheck if you run itEPSS 0.31%Apr 8, 2026
- Medium6.4The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.24%Apr 8, 2026
- High7.2The Gerador de Certificados – DevApps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moveUploadedFile() function in all verCheck if you run itEPSS 0.58%Apr 8, 2026
- Medium5.3The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6.Check if you run itEPSS 0.33%Apr 8, 2026
- Medium4.4The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and including 1.0.Check if you run itEPSS 0.26%Apr 8, 2026
- Medium6.4The Pinterest Site Verification plugin using Meta Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_var' parameter in versions up to, and includinCheck if you run itEPSS 0.21%Apr 8, 2026
Sort