Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Sports Club Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' attributes of the shortcode in all versions up to, and incCheck if you run itEPSS 0.19%Apr 8, 2026
- Critical9.8The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the function in all versions up to, and includingCheck if you run itEPSS 0.94%Apr 8, 2026
- Medium6.5The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14.Check if you run itEPSS 0.36%Apr 8, 2026
- Medium5.3The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4 via the '/wp-json/InkXEProductDesignerLiCheck if you run itEPSS 0.51%Apr 8, 2026
- Medium5.3Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.Check if you run itEPSS 0.42%Apr 8, 2026
- Medium5.1Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier.Check if you run itEPSS 0.23%Apr 8, 2026
- High8.7SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier.Check if you run itEPSS 0.29%Apr 8, 2026
- Medium5.3Ado::Sessions versions through 0.935 for Perl generates insecure session ids.Check if you run itEPSS 0.45%Apr 8, 2026
- Medium6.4The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theCheck if you run itEPSS 0.21%Apr 8, 2026
- Medium5.1Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier.Check if you run itEPSS 0.15%Apr 8, 2026
- Medium6.4The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribute in all versions upCheck if you run itEPSS 0.27%Apr 8, 2026
- Medium6.4The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 dCheck if you run itEPSS 0.21%Apr 8, 2026
- Medium5.3The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3Check if you run itEPSS 0.39%Apr 8, 2026
- Medium6.4The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latCheck if you run itEPSS 0.37%Apr 8, 2026
- Medium5.3The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6.Check if you run itEPSS 0.56%Apr 8, 2026
- Medium6.4The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all versions up toCheck if you run itEPSS 0.37%Apr 8, 2026
- Critical9.8The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15.Patch nowKEVEPSS 0.91%Apr 8, 2026
- Medium6.4The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and includCheck if you run itEPSS 0.27%Apr 8, 2026
- Medium6.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versionCheck if you run itEPSS 0.32%Apr 8, 2026
- High8.4ASDA-Soft Stack-based Buffer Overflow VulnerabilityCheck if you run itEPSS 0.34%Apr 8, 2026
- Medium4.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms.Check if you run itEPSS 0.22%Apr 8, 2026
- Medium6.4The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attribute in the shortcode in all versions up to, and including, 2.3.4.Check if you run itEPSS 0.27%Apr 8, 2026
- Medium6.4The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and including, 11.15.15 duCheck if you run itEPSS 0.21%Apr 8, 2026
- High8.8The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 through 13.5.2.Check if you run itEPSS 0.17%Apr 8, 2026
- Critical9.8WPEverest everest_forms Deserialization of Untrusted DataPatch nowKEVEPSS 3.59%Apr 8, 2026
Sort